# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 15.02.2020 00:39:50.339 Process: id = "1" image_name = "zsywqjjw.exe" filename = "c:\\users\\fd1hvy\\desktop\\zsywqjjw.exe" page_root = "0x1794c000" os_pid = "0x13cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13d0 [0056.033] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0057.044] GetVersionExW (in: lpVersionInformation=0x7472c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x7472c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0057.044] GetLastError () returned 0x0 [0057.045] GetVersionExW (in: lpVersionInformation=0x7472c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x7472c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0057.045] GetLastError () returned 0x0 [0057.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x53e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0057.107] GetLastError () returned 0x0 [0057.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0057.295] GetLastError () returned 0x2 [0057.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e8fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0057.300] GetLastError () returned 0x2 [0057.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x53e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0057.304] GetLastError () returned 0x2 [0057.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x53e960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0057.310] GetLastError () returned 0x2 [0057.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x53e8fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0057.310] GetLastError () returned 0x2 [0058.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e69c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0058.440] GetLastError () returned 0x8013141b [0058.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0058.440] GetLastError () returned 0x8013141b [0058.508] GetCurrentProcessId () returned 0x13cc [0058.563] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x53e350 | out: lpLuid=0x53e350*(LowPart=0x14, HighPart=0)) returned 1 [0058.569] GetLastError () returned 0x0 [0058.571] GetCurrentProcess () returned 0xffffffff [0058.571] GetLastError () returned 0x0 [0058.573] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x53e34c | out: TokenHandle=0x53e34c*=0x310) returned 1 [0058.574] GetLastError () returned 0x0 [0058.591] AdjustTokenPrivileges (in: TokenHandle=0x310, DisableAllPrivileges=0, NewState=0x2652e6c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0058.591] GetLastError () returned 0x0 [0058.593] CloseHandle (hObject=0x310) returned 1 [0058.593] GetLastError () returned 0x0 [0058.598] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x310 [0058.598] GetLastError () returned 0x0 [0058.601] GetExitCodeProcess (in: hProcess=0x310, lpExitCode=0x2652de4 | out: lpExitCode=0x2652de4*=0x103) returned 1 [0058.601] GetLastError () returned 0x0 [0058.606] CheckRemoteDebuggerPresent (in: hProcess=0x310, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.607] GetLastError () returned 0x0 [0058.607] GetCurrentProcessId () returned 0x13cc [0058.607] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x314 [0058.607] GetLastError () returned 0x0 [0058.607] GetExitCodeProcess (in: hProcess=0x314, lpExitCode=0x2652f08 | out: lpExitCode=0x2652f08*=0x103) returned 1 [0058.608] GetLastError () returned 0x0 [0058.608] CheckRemoteDebuggerPresent (in: hProcess=0x314, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.608] GetLastError () returned 0x0 [0058.613] GetCurrentProcessId () returned 0x13cc [0058.613] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x318 [0058.613] GetLastError () returned 0x0 [0058.613] GetExitCodeProcess (in: hProcess=0x318, lpExitCode=0x2653054 | out: lpExitCode=0x2653054*=0x103) returned 1 [0058.613] GetLastError () returned 0x0 [0058.613] CheckRemoteDebuggerPresent (in: hProcess=0x318, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.613] GetLastError () returned 0x0 [0058.613] GetCurrentProcessId () returned 0x13cc [0058.614] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x31c [0058.614] GetLastError () returned 0x0 [0058.614] GetExitCodeProcess (in: hProcess=0x31c, lpExitCode=0x2653108 | out: lpExitCode=0x2653108*=0x103) returned 1 [0058.614] GetLastError () returned 0x0 [0058.614] CheckRemoteDebuggerPresent (in: hProcess=0x31c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.614] GetLastError () returned 0x0 [0058.614] GetCurrentProcessId () returned 0x13cc [0058.614] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x320 [0058.614] GetLastError () returned 0x0 [0058.614] GetExitCodeProcess (in: hProcess=0x320, lpExitCode=0x26531bc | out: lpExitCode=0x26531bc*=0x103) returned 1 [0058.614] GetLastError () returned 0x0 [0058.614] CheckRemoteDebuggerPresent (in: hProcess=0x320, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.614] GetLastError () returned 0x0 [0058.614] GetCurrentProcessId () returned 0x13cc [0058.615] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x324 [0058.615] GetLastError () returned 0x0 [0058.615] GetExitCodeProcess (in: hProcess=0x324, lpExitCode=0x2653270 | out: lpExitCode=0x2653270*=0x103) returned 1 [0058.615] GetLastError () returned 0x0 [0058.615] CheckRemoteDebuggerPresent (in: hProcess=0x324, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.615] GetLastError () returned 0x0 [0058.615] GetCurrentProcessId () returned 0x13cc [0058.615] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x328 [0058.615] GetLastError () returned 0x0 [0058.615] GetExitCodeProcess (in: hProcess=0x328, lpExitCode=0x2653324 | out: lpExitCode=0x2653324*=0x103) returned 1 [0058.615] GetLastError () returned 0x0 [0058.615] CheckRemoteDebuggerPresent (in: hProcess=0x328, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.615] GetLastError () returned 0x0 [0058.616] GetCurrentProcessId () returned 0x13cc [0058.616] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x32c [0058.616] GetLastError () returned 0x0 [0058.616] GetExitCodeProcess (in: hProcess=0x32c, lpExitCode=0x26533d8 | out: lpExitCode=0x26533d8*=0x103) returned 1 [0058.616] GetLastError () returned 0x0 [0058.616] CheckRemoteDebuggerPresent (in: hProcess=0x32c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.616] GetLastError () returned 0x0 [0058.616] GetCurrentProcessId () returned 0x13cc [0058.616] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x330 [0058.616] GetLastError () returned 0x0 [0058.616] GetExitCodeProcess (in: hProcess=0x330, lpExitCode=0x265348c | out: lpExitCode=0x265348c*=0x103) returned 1 [0058.616] GetLastError () returned 0x0 [0058.616] CheckRemoteDebuggerPresent (in: hProcess=0x330, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.616] GetLastError () returned 0x0 [0058.617] GetCurrentProcessId () returned 0x13cc [0058.617] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x334 [0058.617] GetLastError () returned 0x0 [0058.617] GetExitCodeProcess (in: hProcess=0x334, lpExitCode=0x2653540 | out: lpExitCode=0x2653540*=0x103) returned 1 [0058.617] GetLastError () returned 0x0 [0058.617] CheckRemoteDebuggerPresent (in: hProcess=0x334, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.617] GetLastError () returned 0x0 [0058.617] GetCurrentProcessId () returned 0x13cc [0058.617] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x338 [0058.617] GetLastError () returned 0x0 [0058.617] GetExitCodeProcess (in: hProcess=0x338, lpExitCode=0x26535f4 | out: lpExitCode=0x26535f4*=0x103) returned 1 [0058.617] GetLastError () returned 0x0 [0058.617] CheckRemoteDebuggerPresent (in: hProcess=0x338, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.617] GetLastError () returned 0x0 [0058.618] GetCurrentProcessId () returned 0x13cc [0058.618] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x33c [0058.618] GetLastError () returned 0x0 [0058.618] GetExitCodeProcess (in: hProcess=0x33c, lpExitCode=0x26536a8 | out: lpExitCode=0x26536a8*=0x103) returned 1 [0058.618] GetLastError () returned 0x0 [0058.618] CheckRemoteDebuggerPresent (in: hProcess=0x33c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.618] GetLastError () returned 0x0 [0058.618] GetCurrentProcessId () returned 0x13cc [0058.618] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x340 [0058.618] GetLastError () returned 0x0 [0058.618] GetExitCodeProcess (in: hProcess=0x340, lpExitCode=0x265375c | out: lpExitCode=0x265375c*=0x103) returned 1 [0058.618] GetLastError () returned 0x0 [0058.618] CheckRemoteDebuggerPresent (in: hProcess=0x340, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.618] GetLastError () returned 0x0 [0058.619] GetCurrentProcessId () returned 0x13cc [0058.619] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x344 [0058.619] GetLastError () returned 0x0 [0058.619] GetExitCodeProcess (in: hProcess=0x344, lpExitCode=0x2653810 | out: lpExitCode=0x2653810*=0x103) returned 1 [0058.619] GetLastError () returned 0x0 [0058.619] CheckRemoteDebuggerPresent (in: hProcess=0x344, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.619] GetLastError () returned 0x0 [0058.619] GetCurrentProcessId () returned 0x13cc [0058.619] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x348 [0058.619] GetLastError () returned 0x0 [0058.619] GetExitCodeProcess (in: hProcess=0x348, lpExitCode=0x26538c4 | out: lpExitCode=0x26538c4*=0x103) returned 1 [0058.619] GetLastError () returned 0x0 [0058.619] CheckRemoteDebuggerPresent (in: hProcess=0x348, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.619] GetLastError () returned 0x0 [0058.620] GetCurrentProcessId () returned 0x13cc [0058.620] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x34c [0058.620] GetLastError () returned 0x0 [0058.620] GetExitCodeProcess (in: hProcess=0x34c, lpExitCode=0x2653978 | out: lpExitCode=0x2653978*=0x103) returned 1 [0058.620] GetLastError () returned 0x0 [0058.620] CheckRemoteDebuggerPresent (in: hProcess=0x34c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.620] GetLastError () returned 0x0 [0058.621] GetCurrentProcessId () returned 0x13cc [0058.621] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x350 [0058.621] GetLastError () returned 0x0 [0058.621] GetExitCodeProcess (in: hProcess=0x350, lpExitCode=0x2653a2c | out: lpExitCode=0x2653a2c*=0x103) returned 1 [0058.621] GetLastError () returned 0x0 [0058.621] CheckRemoteDebuggerPresent (in: hProcess=0x350, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.622] GetLastError () returned 0x0 [0058.622] GetCurrentProcessId () returned 0x13cc [0058.622] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x354 [0058.622] GetLastError () returned 0x0 [0058.622] GetExitCodeProcess (in: hProcess=0x354, lpExitCode=0x2653ae0 | out: lpExitCode=0x2653ae0*=0x103) returned 1 [0058.622] GetLastError () returned 0x0 [0058.622] CheckRemoteDebuggerPresent (in: hProcess=0x354, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.622] GetLastError () returned 0x0 [0058.626] VirtualProtect (in: lpAddress=0x8a2000, dwSize=0x1aaa0, flNewProtect=0x40, lpflOldProtect=0x53ed00 | out: lpflOldProtect=0x53ed00*=0x80) returned 1 [0058.628] GetCurrentProcessId () returned 0x13cc [0058.628] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x358 [0058.628] GetLastError () returned 0x0 [0058.628] GetExitCodeProcess (in: hProcess=0x358, lpExitCode=0x2653b94 | out: lpExitCode=0x2653b94*=0x103) returned 1 [0058.629] GetLastError () returned 0x0 [0058.629] CheckRemoteDebuggerPresent (in: hProcess=0x358, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.629] GetLastError () returned 0x0 [0058.629] GetCurrentProcessId () returned 0x13cc [0058.629] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x35c [0058.629] GetLastError () returned 0x0 [0058.629] GetExitCodeProcess (in: hProcess=0x35c, lpExitCode=0x2653c48 | out: lpExitCode=0x2653c48*=0x103) returned 1 [0058.629] GetLastError () returned 0x0 [0058.629] CheckRemoteDebuggerPresent (in: hProcess=0x35c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.629] GetLastError () returned 0x0 [0058.629] GetCurrentProcessId () returned 0x13cc [0058.629] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x360 [0058.629] GetLastError () returned 0x0 [0058.629] GetExitCodeProcess (in: hProcess=0x360, lpExitCode=0x2653cfc | out: lpExitCode=0x2653cfc*=0x103) returned 1 [0058.630] GetLastError () returned 0x0 [0058.630] CheckRemoteDebuggerPresent (in: hProcess=0x360, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.630] GetLastError () returned 0x0 [0058.630] GetCurrentProcessId () returned 0x13cc [0058.630] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x364 [0058.630] GetLastError () returned 0x0 [0058.630] GetExitCodeProcess (in: hProcess=0x364, lpExitCode=0x2653db0 | out: lpExitCode=0x2653db0*=0x103) returned 1 [0058.630] GetLastError () returned 0x0 [0058.630] CheckRemoteDebuggerPresent (in: hProcess=0x364, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.630] GetLastError () returned 0x0 [0058.630] GetCurrentProcessId () returned 0x13cc [0058.630] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x368 [0058.630] GetLastError () returned 0x0 [0058.630] GetExitCodeProcess (in: hProcess=0x368, lpExitCode=0x2653e64 | out: lpExitCode=0x2653e64*=0x103) returned 1 [0058.631] GetLastError () returned 0x0 [0058.631] CheckRemoteDebuggerPresent (in: hProcess=0x368, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.631] GetLastError () returned 0x0 [0058.631] GetCurrentProcessId () returned 0x13cc [0058.631] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x36c [0058.631] GetLastError () returned 0x0 [0058.631] GetExitCodeProcess (in: hProcess=0x36c, lpExitCode=0x2653f18 | out: lpExitCode=0x2653f18*=0x103) returned 1 [0058.631] GetLastError () returned 0x0 [0058.631] CheckRemoteDebuggerPresent (in: hProcess=0x36c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.631] GetLastError () returned 0x0 [0058.631] GetCurrentProcessId () returned 0x13cc [0058.631] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x370 [0058.632] GetLastError () returned 0x0 [0058.632] GetExitCodeProcess (in: hProcess=0x370, lpExitCode=0x2653fcc | out: lpExitCode=0x2653fcc*=0x103) returned 1 [0058.632] GetLastError () returned 0x0 [0058.632] CheckRemoteDebuggerPresent (in: hProcess=0x370, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.632] GetLastError () returned 0x0 [0058.632] GetCurrentProcessId () returned 0x13cc [0058.632] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x374 [0058.632] GetLastError () returned 0x0 [0058.632] GetExitCodeProcess (in: hProcess=0x374, lpExitCode=0x2654080 | out: lpExitCode=0x2654080*=0x103) returned 1 [0058.632] GetLastError () returned 0x0 [0058.632] CheckRemoteDebuggerPresent (in: hProcess=0x374, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.632] GetLastError () returned 0x0 [0058.632] GetCurrentProcessId () returned 0x13cc [0058.632] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x378 [0058.633] GetLastError () returned 0x0 [0058.633] GetExitCodeProcess (in: hProcess=0x378, lpExitCode=0x2654134 | out: lpExitCode=0x2654134*=0x103) returned 1 [0058.633] GetLastError () returned 0x0 [0058.633] CheckRemoteDebuggerPresent (in: hProcess=0x378, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.633] GetLastError () returned 0x0 [0058.633] GetCurrentProcessId () returned 0x13cc [0058.633] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x37c [0058.633] GetLastError () returned 0x0 [0058.633] GetExitCodeProcess (in: hProcess=0x37c, lpExitCode=0x26541e8 | out: lpExitCode=0x26541e8*=0x103) returned 1 [0058.633] GetLastError () returned 0x0 [0058.633] CheckRemoteDebuggerPresent (in: hProcess=0x37c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.633] GetLastError () returned 0x0 [0058.633] GetCurrentProcessId () returned 0x13cc [0058.633] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x380 [0058.633] GetLastError () returned 0x0 [0058.634] GetExitCodeProcess (in: hProcess=0x380, lpExitCode=0x265429c | out: lpExitCode=0x265429c*=0x103) returned 1 [0058.634] GetLastError () returned 0x0 [0058.634] CheckRemoteDebuggerPresent (in: hProcess=0x380, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.634] GetLastError () returned 0x0 [0058.634] GetCurrentProcessId () returned 0x13cc [0058.634] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x384 [0058.634] GetLastError () returned 0x0 [0058.634] GetExitCodeProcess (in: hProcess=0x384, lpExitCode=0x2654350 | out: lpExitCode=0x2654350*=0x103) returned 1 [0058.634] GetLastError () returned 0x0 [0058.634] CheckRemoteDebuggerPresent (in: hProcess=0x384, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.634] GetLastError () returned 0x0 [0058.634] GetCurrentProcessId () returned 0x13cc [0058.634] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x388 [0058.634] GetLastError () returned 0x0 [0058.635] GetExitCodeProcess (in: hProcess=0x388, lpExitCode=0x2654404 | out: lpExitCode=0x2654404*=0x103) returned 1 [0058.635] GetLastError () returned 0x0 [0058.635] CheckRemoteDebuggerPresent (in: hProcess=0x388, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.635] GetLastError () returned 0x0 [0058.635] GetCurrentProcessId () returned 0x13cc [0058.635] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x38c [0058.635] GetLastError () returned 0x0 [0058.635] GetExitCodeProcess (in: hProcess=0x38c, lpExitCode=0x26544b8 | out: lpExitCode=0x26544b8*=0x103) returned 1 [0058.635] GetLastError () returned 0x0 [0058.635] CheckRemoteDebuggerPresent (in: hProcess=0x38c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.635] GetLastError () returned 0x0 [0058.635] GetCurrentProcessId () returned 0x13cc [0058.635] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x390 [0058.635] GetLastError () returned 0x0 [0058.636] GetExitCodeProcess (in: hProcess=0x390, lpExitCode=0x265456c | out: lpExitCode=0x265456c*=0x103) returned 1 [0058.636] GetLastError () returned 0x0 [0058.636] CheckRemoteDebuggerPresent (in: hProcess=0x390, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.738] GetLastError () returned 0x0 [0058.738] GetCurrentProcessId () returned 0x13cc [0058.739] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x394 [0058.739] GetLastError () returned 0x0 [0058.739] GetExitCodeProcess (in: hProcess=0x394, lpExitCode=0x2654620 | out: lpExitCode=0x2654620*=0x103) returned 1 [0058.739] GetLastError () returned 0x0 [0058.739] CheckRemoteDebuggerPresent (in: hProcess=0x394, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.739] GetLastError () returned 0x0 [0058.739] GetCurrentProcessId () returned 0x13cc [0058.739] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x398 [0058.739] GetLastError () returned 0x0 [0058.739] GetExitCodeProcess (in: hProcess=0x398, lpExitCode=0x26546d4 | out: lpExitCode=0x26546d4*=0x103) returned 1 [0058.739] GetLastError () returned 0x0 [0058.740] CheckRemoteDebuggerPresent (in: hProcess=0x398, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.740] GetLastError () returned 0x0 [0058.740] GetCurrentProcessId () returned 0x13cc [0058.740] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x39c [0058.740] GetLastError () returned 0x0 [0058.740] GetExitCodeProcess (in: hProcess=0x39c, lpExitCode=0x2654788 | out: lpExitCode=0x2654788*=0x103) returned 1 [0058.740] GetLastError () returned 0x0 [0058.740] CheckRemoteDebuggerPresent (in: hProcess=0x39c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.740] GetLastError () returned 0x0 [0058.740] GetCurrentProcessId () returned 0x13cc [0058.740] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3a0 [0058.740] GetLastError () returned 0x0 [0058.740] GetExitCodeProcess (in: hProcess=0x3a0, lpExitCode=0x265483c | out: lpExitCode=0x265483c*=0x103) returned 1 [0058.740] GetLastError () returned 0x0 [0058.740] CheckRemoteDebuggerPresent (in: hProcess=0x3a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.740] GetLastError () returned 0x0 [0058.740] GetCurrentProcessId () returned 0x13cc [0058.740] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3a4 [0058.740] GetLastError () returned 0x0 [0058.741] GetExitCodeProcess (in: hProcess=0x3a4, lpExitCode=0x26548f0 | out: lpExitCode=0x26548f0*=0x103) returned 1 [0058.741] GetLastError () returned 0x0 [0058.741] CheckRemoteDebuggerPresent (in: hProcess=0x3a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.741] GetLastError () returned 0x0 [0058.741] GetCurrentProcessId () returned 0x13cc [0058.741] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3a8 [0058.741] GetLastError () returned 0x0 [0058.741] GetExitCodeProcess (in: hProcess=0x3a8, lpExitCode=0x26549a4 | out: lpExitCode=0x26549a4*=0x103) returned 1 [0058.741] GetLastError () returned 0x0 [0058.741] CheckRemoteDebuggerPresent (in: hProcess=0x3a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.741] GetLastError () returned 0x0 [0058.741] GetCurrentProcessId () returned 0x13cc [0058.741] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3ac [0058.741] GetLastError () returned 0x0 [0058.741] GetExitCodeProcess (in: hProcess=0x3ac, lpExitCode=0x2654a58 | out: lpExitCode=0x2654a58*=0x103) returned 1 [0058.741] GetLastError () returned 0x0 [0058.741] CheckRemoteDebuggerPresent (in: hProcess=0x3ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.741] GetLastError () returned 0x0 [0058.741] GetCurrentProcessId () returned 0x13cc [0058.742] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3b0 [0058.742] GetLastError () returned 0x0 [0058.742] GetExitCodeProcess (in: hProcess=0x3b0, lpExitCode=0x2654b0c | out: lpExitCode=0x2654b0c*=0x103) returned 1 [0058.742] GetLastError () returned 0x0 [0058.742] CheckRemoteDebuggerPresent (in: hProcess=0x3b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.742] GetLastError () returned 0x0 [0058.742] GetCurrentProcessId () returned 0x13cc [0058.742] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3b4 [0058.742] GetLastError () returned 0x0 [0058.742] GetExitCodeProcess (in: hProcess=0x3b4, lpExitCode=0x2654bc0 | out: lpExitCode=0x2654bc0*=0x103) returned 1 [0058.742] GetLastError () returned 0x0 [0058.742] CheckRemoteDebuggerPresent (in: hProcess=0x3b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.742] GetLastError () returned 0x0 [0058.742] GetCurrentProcessId () returned 0x13cc [0058.742] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3b8 [0058.742] GetLastError () returned 0x0 [0058.742] GetExitCodeProcess (in: hProcess=0x3b8, lpExitCode=0x2654c74 | out: lpExitCode=0x2654c74*=0x103) returned 1 [0058.742] GetLastError () returned 0x0 [0058.742] CheckRemoteDebuggerPresent (in: hProcess=0x3b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.742] GetLastError () returned 0x0 [0058.743] GetCurrentProcessId () returned 0x13cc [0058.743] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3bc [0058.743] GetLastError () returned 0x0 [0058.743] GetExitCodeProcess (in: hProcess=0x3bc, lpExitCode=0x2654d28 | out: lpExitCode=0x2654d28*=0x103) returned 1 [0058.743] GetLastError () returned 0x0 [0058.743] CheckRemoteDebuggerPresent (in: hProcess=0x3bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.743] GetLastError () returned 0x0 [0058.743] GetCurrentProcessId () returned 0x13cc [0058.743] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3c0 [0058.743] GetLastError () returned 0x0 [0058.743] GetExitCodeProcess (in: hProcess=0x3c0, lpExitCode=0x2654ddc | out: lpExitCode=0x2654ddc*=0x103) returned 1 [0058.743] GetLastError () returned 0x0 [0058.743] CheckRemoteDebuggerPresent (in: hProcess=0x3c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.743] GetLastError () returned 0x0 [0058.743] GetCurrentProcessId () returned 0x13cc [0058.743] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3c4 [0058.743] GetLastError () returned 0x0 [0058.743] GetExitCodeProcess (in: hProcess=0x3c4, lpExitCode=0x2654e90 | out: lpExitCode=0x2654e90*=0x103) returned 1 [0058.743] GetLastError () returned 0x0 [0058.744] CheckRemoteDebuggerPresent (in: hProcess=0x3c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.744] GetLastError () returned 0x0 [0058.744] GetCurrentProcessId () returned 0x13cc [0058.744] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3c8 [0058.744] GetLastError () returned 0x0 [0058.744] GetExitCodeProcess (in: hProcess=0x3c8, lpExitCode=0x2654f44 | out: lpExitCode=0x2654f44*=0x103) returned 1 [0058.744] GetLastError () returned 0x0 [0058.744] CheckRemoteDebuggerPresent (in: hProcess=0x3c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.744] GetLastError () returned 0x0 [0058.744] GetCurrentProcessId () returned 0x13cc [0058.744] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3cc [0058.744] GetLastError () returned 0x0 [0058.744] GetExitCodeProcess (in: hProcess=0x3cc, lpExitCode=0x2654ff8 | out: lpExitCode=0x2654ff8*=0x103) returned 1 [0058.744] GetLastError () returned 0x0 [0058.744] CheckRemoteDebuggerPresent (in: hProcess=0x3cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.744] GetLastError () returned 0x0 [0058.744] GetCurrentProcessId () returned 0x13cc [0058.745] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3d0 [0058.745] GetLastError () returned 0x0 [0058.745] GetExitCodeProcess (in: hProcess=0x3d0, lpExitCode=0x26550ac | out: lpExitCode=0x26550ac*=0x103) returned 1 [0058.745] GetLastError () returned 0x0 [0058.745] CheckRemoteDebuggerPresent (in: hProcess=0x3d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.745] GetLastError () returned 0x0 [0058.745] GetCurrentProcessId () returned 0x13cc [0058.745] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3d4 [0058.745] GetLastError () returned 0x0 [0058.747] GetExitCodeProcess (in: hProcess=0x3d4, lpExitCode=0x2655160 | out: lpExitCode=0x2655160*=0x103) returned 1 [0058.747] GetLastError () returned 0x0 [0058.747] CheckRemoteDebuggerPresent (in: hProcess=0x3d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.748] GetLastError () returned 0x0 [0058.748] GetCurrentProcessId () returned 0x13cc [0058.748] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3d8 [0058.748] GetLastError () returned 0x0 [0058.748] GetExitCodeProcess (in: hProcess=0x3d8, lpExitCode=0x2655214 | out: lpExitCode=0x2655214*=0x103) returned 1 [0058.748] GetLastError () returned 0x0 [0058.748] CheckRemoteDebuggerPresent (in: hProcess=0x3d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.748] GetLastError () returned 0x0 [0058.748] GetCurrentProcessId () returned 0x13cc [0058.748] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3dc [0058.748] GetLastError () returned 0x0 [0058.748] GetExitCodeProcess (in: hProcess=0x3dc, lpExitCode=0x26552c8 | out: lpExitCode=0x26552c8*=0x103) returned 1 [0058.748] GetLastError () returned 0x0 [0058.748] CheckRemoteDebuggerPresent (in: hProcess=0x3dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.748] GetLastError () returned 0x0 [0058.748] GetCurrentProcessId () returned 0x13cc [0058.748] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3e0 [0058.748] GetLastError () returned 0x0 [0058.749] GetExitCodeProcess (in: hProcess=0x3e0, lpExitCode=0x265537c | out: lpExitCode=0x265537c*=0x103) returned 1 [0058.749] GetLastError () returned 0x0 [0058.749] CheckRemoteDebuggerPresent (in: hProcess=0x3e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.749] GetLastError () returned 0x0 [0058.749] GetCurrentProcessId () returned 0x13cc [0058.749] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3e4 [0058.749] GetLastError () returned 0x0 [0058.749] GetExitCodeProcess (in: hProcess=0x3e4, lpExitCode=0x2655430 | out: lpExitCode=0x2655430*=0x103) returned 1 [0058.749] GetLastError () returned 0x0 [0058.749] CheckRemoteDebuggerPresent (in: hProcess=0x3e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.749] GetLastError () returned 0x0 [0058.749] GetCurrentProcessId () returned 0x13cc [0058.749] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3e8 [0058.749] GetLastError () returned 0x0 [0058.749] GetExitCodeProcess (in: hProcess=0x3e8, lpExitCode=0x26554e4 | out: lpExitCode=0x26554e4*=0x103) returned 1 [0058.749] GetLastError () returned 0x0 [0058.749] CheckRemoteDebuggerPresent (in: hProcess=0x3e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.749] GetLastError () returned 0x0 [0058.750] GetCurrentProcessId () returned 0x13cc [0058.750] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3ec [0058.750] GetLastError () returned 0x0 [0058.750] GetExitCodeProcess (in: hProcess=0x3ec, lpExitCode=0x2655598 | out: lpExitCode=0x2655598*=0x103) returned 1 [0058.750] GetLastError () returned 0x0 [0058.750] CheckRemoteDebuggerPresent (in: hProcess=0x3ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.750] GetLastError () returned 0x0 [0058.750] GetCurrentProcessId () returned 0x13cc [0058.750] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3f0 [0058.750] GetLastError () returned 0x0 [0058.750] GetExitCodeProcess (in: hProcess=0x3f0, lpExitCode=0x265564c | out: lpExitCode=0x265564c*=0x103) returned 1 [0058.750] GetLastError () returned 0x0 [0058.750] CheckRemoteDebuggerPresent (in: hProcess=0x3f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.750] GetLastError () returned 0x0 [0058.750] GetCurrentProcessId () returned 0x13cc [0058.751] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3f4 [0058.751] GetLastError () returned 0x0 [0058.751] GetExitCodeProcess (in: hProcess=0x3f4, lpExitCode=0x2655700 | out: lpExitCode=0x2655700*=0x103) returned 1 [0058.751] GetLastError () returned 0x0 [0058.751] CheckRemoteDebuggerPresent (in: hProcess=0x3f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.751] GetLastError () returned 0x0 [0058.751] GetCurrentProcessId () returned 0x13cc [0058.751] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3f8 [0058.751] GetLastError () returned 0x0 [0058.751] GetExitCodeProcess (in: hProcess=0x3f8, lpExitCode=0x26557b4 | out: lpExitCode=0x26557b4*=0x103) returned 1 [0058.751] GetLastError () returned 0x0 [0058.751] CheckRemoteDebuggerPresent (in: hProcess=0x3f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.751] GetLastError () returned 0x0 [0058.751] GetCurrentProcessId () returned 0x13cc [0058.751] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x3fc [0058.752] GetLastError () returned 0x0 [0058.752] GetExitCodeProcess (in: hProcess=0x3fc, lpExitCode=0x2655868 | out: lpExitCode=0x2655868*=0x103) returned 1 [0058.752] GetLastError () returned 0x0 [0058.752] CheckRemoteDebuggerPresent (in: hProcess=0x3fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.752] GetLastError () returned 0x0 [0058.752] GetCurrentProcessId () returned 0x13cc [0058.752] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x404 [0058.752] GetLastError () returned 0x0 [0058.752] GetExitCodeProcess (in: hProcess=0x404, lpExitCode=0x265591c | out: lpExitCode=0x265591c*=0x103) returned 1 [0058.752] GetLastError () returned 0x0 [0058.752] CheckRemoteDebuggerPresent (in: hProcess=0x404, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.752] GetLastError () returned 0x0 [0058.752] GetCurrentProcessId () returned 0x13cc [0058.753] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x408 [0058.753] GetLastError () returned 0x0 [0058.753] GetExitCodeProcess (in: hProcess=0x408, lpExitCode=0x26559d0 | out: lpExitCode=0x26559d0*=0x103) returned 1 [0058.753] GetLastError () returned 0x0 [0058.753] CheckRemoteDebuggerPresent (in: hProcess=0x408, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.753] GetLastError () returned 0x0 [0058.753] GetCurrentProcessId () returned 0x13cc [0058.753] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x40c [0058.753] GetLastError () returned 0x0 [0058.753] GetExitCodeProcess (in: hProcess=0x40c, lpExitCode=0x2655a84 | out: lpExitCode=0x2655a84*=0x103) returned 1 [0058.753] GetLastError () returned 0x0 [0058.753] CheckRemoteDebuggerPresent (in: hProcess=0x40c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.753] GetLastError () returned 0x0 [0058.753] GetCurrentProcessId () returned 0x13cc [0058.754] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x410 [0058.754] GetLastError () returned 0x0 [0058.754] GetExitCodeProcess (in: hProcess=0x410, lpExitCode=0x2655b38 | out: lpExitCode=0x2655b38*=0x103) returned 1 [0058.754] GetLastError () returned 0x0 [0058.754] CheckRemoteDebuggerPresent (in: hProcess=0x410, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.754] GetLastError () returned 0x0 [0058.754] GetCurrentProcessId () returned 0x13cc [0058.754] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x414 [0058.754] GetLastError () returned 0x0 [0058.754] GetExitCodeProcess (in: hProcess=0x414, lpExitCode=0x2655bec | out: lpExitCode=0x2655bec*=0x103) returned 1 [0058.754] GetLastError () returned 0x0 [0058.754] CheckRemoteDebuggerPresent (in: hProcess=0x414, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.754] GetLastError () returned 0x0 [0058.754] GetCurrentProcessId () returned 0x13cc [0058.755] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x418 [0058.755] GetLastError () returned 0x0 [0058.755] GetExitCodeProcess (in: hProcess=0x418, lpExitCode=0x2655ca0 | out: lpExitCode=0x2655ca0*=0x103) returned 1 [0058.755] GetLastError () returned 0x0 [0058.755] CheckRemoteDebuggerPresent (in: hProcess=0x418, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.755] GetLastError () returned 0x0 [0058.755] GetCurrentProcessId () returned 0x13cc [0058.755] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x41c [0058.755] GetLastError () returned 0x0 [0058.755] GetExitCodeProcess (in: hProcess=0x41c, lpExitCode=0x2655d54 | out: lpExitCode=0x2655d54*=0x103) returned 1 [0058.755] GetLastError () returned 0x0 [0058.755] CheckRemoteDebuggerPresent (in: hProcess=0x41c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.755] GetLastError () returned 0x0 [0058.755] GetCurrentProcessId () returned 0x13cc [0058.756] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x420 [0058.756] GetLastError () returned 0x0 [0058.756] GetExitCodeProcess (in: hProcess=0x420, lpExitCode=0x2655e08 | out: lpExitCode=0x2655e08*=0x103) returned 1 [0058.756] GetLastError () returned 0x0 [0058.756] CheckRemoteDebuggerPresent (in: hProcess=0x420, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.756] GetLastError () returned 0x0 [0058.756] GetCurrentProcessId () returned 0x13cc [0058.756] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x424 [0058.756] GetLastError () returned 0x0 [0058.756] GetExitCodeProcess (in: hProcess=0x424, lpExitCode=0x2655ebc | out: lpExitCode=0x2655ebc*=0x103) returned 1 [0058.756] GetLastError () returned 0x0 [0058.756] CheckRemoteDebuggerPresent (in: hProcess=0x424, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.756] GetLastError () returned 0x0 [0058.756] GetCurrentProcessId () returned 0x13cc [0058.757] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x428 [0058.757] GetLastError () returned 0x0 [0058.757] GetExitCodeProcess (in: hProcess=0x428, lpExitCode=0x2655f70 | out: lpExitCode=0x2655f70*=0x103) returned 1 [0058.757] GetLastError () returned 0x0 [0058.757] CheckRemoteDebuggerPresent (in: hProcess=0x428, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.757] GetLastError () returned 0x0 [0058.757] GetCurrentProcessId () returned 0x13cc [0058.757] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x42c [0058.758] GetLastError () returned 0x0 [0058.758] GetExitCodeProcess (in: hProcess=0x42c, lpExitCode=0x2656024 | out: lpExitCode=0x2656024*=0x103) returned 1 [0058.758] GetLastError () returned 0x0 [0058.758] CheckRemoteDebuggerPresent (in: hProcess=0x42c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.758] GetLastError () returned 0x0 [0058.758] GetCurrentProcessId () returned 0x13cc [0058.758] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x430 [0058.758] GetLastError () returned 0x0 [0058.758] GetExitCodeProcess (in: hProcess=0x430, lpExitCode=0x26560d8 | out: lpExitCode=0x26560d8*=0x103) returned 1 [0058.758] GetLastError () returned 0x0 [0058.758] CheckRemoteDebuggerPresent (in: hProcess=0x430, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.758] GetLastError () returned 0x0 [0058.758] GetCurrentProcessId () returned 0x13cc [0058.759] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x434 [0058.759] GetLastError () returned 0x0 [0058.759] GetExitCodeProcess (in: hProcess=0x434, lpExitCode=0x265618c | out: lpExitCode=0x265618c*=0x103) returned 1 [0058.759] GetLastError () returned 0x0 [0058.759] CheckRemoteDebuggerPresent (in: hProcess=0x434, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.759] GetLastError () returned 0x0 [0058.759] GetCurrentProcessId () returned 0x13cc [0058.759] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x438 [0058.759] GetLastError () returned 0x0 [0058.759] GetExitCodeProcess (in: hProcess=0x438, lpExitCode=0x2656240 | out: lpExitCode=0x2656240*=0x103) returned 1 [0058.759] GetLastError () returned 0x0 [0058.759] CheckRemoteDebuggerPresent (in: hProcess=0x438, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.759] GetLastError () returned 0x0 [0058.759] GetCurrentProcessId () returned 0x13cc [0058.760] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x43c [0058.760] GetLastError () returned 0x0 [0058.760] GetExitCodeProcess (in: hProcess=0x43c, lpExitCode=0x26562f4 | out: lpExitCode=0x26562f4*=0x103) returned 1 [0058.760] GetLastError () returned 0x0 [0058.760] CheckRemoteDebuggerPresent (in: hProcess=0x43c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.760] GetLastError () returned 0x0 [0058.760] GetCurrentProcessId () returned 0x13cc [0058.760] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x440 [0058.760] GetLastError () returned 0x0 [0058.760] GetExitCodeProcess (in: hProcess=0x440, lpExitCode=0x26563a8 | out: lpExitCode=0x26563a8*=0x103) returned 1 [0058.760] GetLastError () returned 0x0 [0058.760] CheckRemoteDebuggerPresent (in: hProcess=0x440, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.760] GetLastError () returned 0x0 [0058.760] GetCurrentProcessId () returned 0x13cc [0058.761] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x444 [0058.761] GetLastError () returned 0x0 [0058.761] GetExitCodeProcess (in: hProcess=0x444, lpExitCode=0x265645c | out: lpExitCode=0x265645c*=0x103) returned 1 [0058.761] GetLastError () returned 0x0 [0058.761] CheckRemoteDebuggerPresent (in: hProcess=0x444, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.761] GetLastError () returned 0x0 [0058.761] GetCurrentProcessId () returned 0x13cc [0058.761] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x448 [0058.762] GetLastError () returned 0x0 [0058.762] GetExitCodeProcess (in: hProcess=0x448, lpExitCode=0x2656510 | out: lpExitCode=0x2656510*=0x103) returned 1 [0058.762] GetLastError () returned 0x0 [0058.762] CheckRemoteDebuggerPresent (in: hProcess=0x448, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.762] GetLastError () returned 0x0 [0058.762] GetCurrentProcessId () returned 0x13cc [0058.762] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x44c [0058.762] GetLastError () returned 0x0 [0058.762] GetExitCodeProcess (in: hProcess=0x44c, lpExitCode=0x26565c4 | out: lpExitCode=0x26565c4*=0x103) returned 1 [0058.762] GetLastError () returned 0x0 [0058.762] CheckRemoteDebuggerPresent (in: hProcess=0x44c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.762] GetLastError () returned 0x0 [0058.763] GetCurrentProcessId () returned 0x13cc [0058.763] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x450 [0058.763] GetLastError () returned 0x0 [0058.763] GetExitCodeProcess (in: hProcess=0x450, lpExitCode=0x2656678 | out: lpExitCode=0x2656678*=0x103) returned 1 [0058.763] GetLastError () returned 0x0 [0058.763] CheckRemoteDebuggerPresent (in: hProcess=0x450, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.763] GetLastError () returned 0x0 [0058.763] GetCurrentProcessId () returned 0x13cc [0058.763] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x454 [0058.763] GetLastError () returned 0x0 [0058.763] GetExitCodeProcess (in: hProcess=0x454, lpExitCode=0x265672c | out: lpExitCode=0x265672c*=0x103) returned 1 [0058.763] GetLastError () returned 0x0 [0058.763] CheckRemoteDebuggerPresent (in: hProcess=0x454, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.764] GetLastError () returned 0x0 [0058.764] GetCurrentProcessId () returned 0x13cc [0058.764] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x458 [0058.764] GetLastError () returned 0x0 [0058.764] GetExitCodeProcess (in: hProcess=0x458, lpExitCode=0x26567e0 | out: lpExitCode=0x26567e0*=0x103) returned 1 [0058.764] GetLastError () returned 0x0 [0058.764] CheckRemoteDebuggerPresent (in: hProcess=0x458, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.764] GetLastError () returned 0x0 [0058.764] GetCurrentProcessId () returned 0x13cc [0058.764] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x45c [0058.764] GetLastError () returned 0x0 [0058.764] GetExitCodeProcess (in: hProcess=0x45c, lpExitCode=0x2656894 | out: lpExitCode=0x2656894*=0x103) returned 1 [0058.764] GetLastError () returned 0x0 [0058.765] CheckRemoteDebuggerPresent (in: hProcess=0x45c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.765] GetLastError () returned 0x0 [0058.765] GetCurrentProcessId () returned 0x13cc [0058.765] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x460 [0058.765] GetLastError () returned 0x0 [0058.765] GetExitCodeProcess (in: hProcess=0x460, lpExitCode=0x2656948 | out: lpExitCode=0x2656948*=0x103) returned 1 [0058.765] GetLastError () returned 0x0 [0058.765] CheckRemoteDebuggerPresent (in: hProcess=0x460, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.765] GetLastError () returned 0x0 [0058.765] GetCurrentProcessId () returned 0x13cc [0058.765] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x464 [0058.765] GetLastError () returned 0x0 [0058.766] GetExitCodeProcess (in: hProcess=0x464, lpExitCode=0x26569fc | out: lpExitCode=0x26569fc*=0x103) returned 1 [0058.766] GetLastError () returned 0x0 [0058.766] CheckRemoteDebuggerPresent (in: hProcess=0x464, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.766] GetLastError () returned 0x0 [0058.766] GetCurrentProcessId () returned 0x13cc [0058.766] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x468 [0058.766] GetLastError () returned 0x0 [0058.766] GetExitCodeProcess (in: hProcess=0x468, lpExitCode=0x2656ab0 | out: lpExitCode=0x2656ab0*=0x103) returned 1 [0058.766] GetLastError () returned 0x0 [0058.766] CheckRemoteDebuggerPresent (in: hProcess=0x468, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.766] GetLastError () returned 0x0 [0058.766] GetCurrentProcessId () returned 0x13cc [0058.766] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x46c [0058.767] GetLastError () returned 0x0 [0058.767] GetExitCodeProcess (in: hProcess=0x46c, lpExitCode=0x2656b64 | out: lpExitCode=0x2656b64*=0x103) returned 1 [0058.767] GetLastError () returned 0x0 [0058.767] CheckRemoteDebuggerPresent (in: hProcess=0x46c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.767] GetLastError () returned 0x0 [0058.767] GetCurrentProcessId () returned 0x13cc [0058.767] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x470 [0058.767] GetLastError () returned 0x0 [0058.767] GetExitCodeProcess (in: hProcess=0x470, lpExitCode=0x2656c18 | out: lpExitCode=0x2656c18*=0x103) returned 1 [0058.767] GetLastError () returned 0x0 [0058.767] CheckRemoteDebuggerPresent (in: hProcess=0x470, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.767] GetLastError () returned 0x0 [0058.767] GetCurrentProcessId () returned 0x13cc [0058.768] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x474 [0058.768] GetLastError () returned 0x0 [0058.768] GetExitCodeProcess (in: hProcess=0x474, lpExitCode=0x2656ccc | out: lpExitCode=0x2656ccc*=0x103) returned 1 [0058.768] GetLastError () returned 0x0 [0058.768] CheckRemoteDebuggerPresent (in: hProcess=0x474, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.768] GetLastError () returned 0x0 [0058.768] GetCurrentProcessId () returned 0x13cc [0058.768] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x478 [0058.768] GetLastError () returned 0x0 [0058.768] GetExitCodeProcess (in: hProcess=0x478, lpExitCode=0x2656d80 | out: lpExitCode=0x2656d80*=0x103) returned 1 [0058.768] GetLastError () returned 0x0 [0058.768] CheckRemoteDebuggerPresent (in: hProcess=0x478, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.768] GetLastError () returned 0x0 [0058.768] GetCurrentProcessId () returned 0x13cc [0058.769] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x47c [0058.769] GetLastError () returned 0x0 [0058.769] GetExitCodeProcess (in: hProcess=0x47c, lpExitCode=0x2656e34 | out: lpExitCode=0x2656e34*=0x103) returned 1 [0058.769] GetLastError () returned 0x0 [0058.769] CheckRemoteDebuggerPresent (in: hProcess=0x47c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.769] GetLastError () returned 0x0 [0058.769] GetCurrentProcessId () returned 0x13cc [0058.769] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x480 [0058.769] GetLastError () returned 0x0 [0058.769] GetExitCodeProcess (in: hProcess=0x480, lpExitCode=0x2656ee8 | out: lpExitCode=0x2656ee8*=0x103) returned 1 [0058.769] GetLastError () returned 0x0 [0058.769] CheckRemoteDebuggerPresent (in: hProcess=0x480, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.770] GetLastError () returned 0x0 [0058.770] GetCurrentProcessId () returned 0x13cc [0058.770] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x484 [0058.770] GetLastError () returned 0x0 [0058.770] GetExitCodeProcess (in: hProcess=0x484, lpExitCode=0x2656f9c | out: lpExitCode=0x2656f9c*=0x103) returned 1 [0058.770] GetLastError () returned 0x0 [0058.770] CheckRemoteDebuggerPresent (in: hProcess=0x484, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.770] GetLastError () returned 0x0 [0058.770] GetCurrentProcessId () returned 0x13cc [0058.770] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x488 [0058.770] GetLastError () returned 0x0 [0058.770] GetExitCodeProcess (in: hProcess=0x488, lpExitCode=0x2657050 | out: lpExitCode=0x2657050*=0x103) returned 1 [0058.770] GetLastError () returned 0x0 [0058.771] CheckRemoteDebuggerPresent (in: hProcess=0x488, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.771] GetLastError () returned 0x0 [0058.771] GetCurrentProcessId () returned 0x13cc [0058.771] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x48c [0058.771] GetLastError () returned 0x0 [0058.771] GetExitCodeProcess (in: hProcess=0x48c, lpExitCode=0x2657104 | out: lpExitCode=0x2657104*=0x103) returned 1 [0058.771] GetLastError () returned 0x0 [0058.771] CheckRemoteDebuggerPresent (in: hProcess=0x48c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.771] GetLastError () returned 0x0 [0058.771] GetCurrentProcessId () returned 0x13cc [0058.771] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x490 [0058.771] GetLastError () returned 0x0 [0058.771] GetExitCodeProcess (in: hProcess=0x490, lpExitCode=0x26571b8 | out: lpExitCode=0x26571b8*=0x103) returned 1 [0058.772] GetLastError () returned 0x0 [0058.772] CheckRemoteDebuggerPresent (in: hProcess=0x490, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.772] GetLastError () returned 0x0 [0058.772] GetCurrentProcessId () returned 0x13cc [0058.772] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x494 [0058.772] GetLastError () returned 0x0 [0058.772] GetExitCodeProcess (in: hProcess=0x494, lpExitCode=0x265726c | out: lpExitCode=0x265726c*=0x103) returned 1 [0058.772] GetLastError () returned 0x0 [0058.772] CheckRemoteDebuggerPresent (in: hProcess=0x494, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.772] GetLastError () returned 0x0 [0058.772] GetCurrentProcessId () returned 0x13cc [0058.772] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x498 [0058.772] GetLastError () returned 0x0 [0058.772] GetExitCodeProcess (in: hProcess=0x498, lpExitCode=0x2657320 | out: lpExitCode=0x2657320*=0x103) returned 1 [0058.773] GetLastError () returned 0x0 [0058.773] CheckRemoteDebuggerPresent (in: hProcess=0x498, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.773] GetLastError () returned 0x0 [0058.773] GetCurrentProcessId () returned 0x13cc [0058.773] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x49c [0058.773] GetLastError () returned 0x0 [0058.773] GetExitCodeProcess (in: hProcess=0x49c, lpExitCode=0x26573d4 | out: lpExitCode=0x26573d4*=0x103) returned 1 [0058.773] GetLastError () returned 0x0 [0058.773] CheckRemoteDebuggerPresent (in: hProcess=0x49c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.773] GetLastError () returned 0x0 [0058.773] GetCurrentProcessId () returned 0x13cc [0058.773] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4a0 [0058.773] GetLastError () returned 0x0 [0058.773] GetExitCodeProcess (in: hProcess=0x4a0, lpExitCode=0x2657488 | out: lpExitCode=0x2657488*=0x103) returned 1 [0058.774] GetLastError () returned 0x0 [0058.774] CheckRemoteDebuggerPresent (in: hProcess=0x4a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.774] GetLastError () returned 0x0 [0058.774] GetCurrentProcessId () returned 0x13cc [0058.774] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4a4 [0058.774] GetLastError () returned 0x0 [0058.774] GetExitCodeProcess (in: hProcess=0x4a4, lpExitCode=0x265753c | out: lpExitCode=0x265753c*=0x103) returned 1 [0058.774] GetLastError () returned 0x0 [0058.774] CheckRemoteDebuggerPresent (in: hProcess=0x4a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.774] GetLastError () returned 0x0 [0058.774] GetCurrentProcessId () returned 0x13cc [0058.775] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4a8 [0058.775] GetLastError () returned 0x0 [0058.775] GetExitCodeProcess (in: hProcess=0x4a8, lpExitCode=0x26575f0 | out: lpExitCode=0x26575f0*=0x103) returned 1 [0058.775] GetLastError () returned 0x0 [0058.775] CheckRemoteDebuggerPresent (in: hProcess=0x4a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.775] GetLastError () returned 0x0 [0058.775] GetCurrentProcessId () returned 0x13cc [0058.775] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4ac [0058.775] GetLastError () returned 0x0 [0058.775] GetExitCodeProcess (in: hProcess=0x4ac, lpExitCode=0x26576a4 | out: lpExitCode=0x26576a4*=0x103) returned 1 [0058.775] GetLastError () returned 0x0 [0058.775] CheckRemoteDebuggerPresent (in: hProcess=0x4ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.775] GetLastError () returned 0x0 [0058.775] GetCurrentProcessId () returned 0x13cc [0058.776] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4b0 [0058.776] GetLastError () returned 0x0 [0058.776] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x2657758 | out: lpExitCode=0x2657758*=0x103) returned 1 [0058.776] GetLastError () returned 0x0 [0058.776] CheckRemoteDebuggerPresent (in: hProcess=0x4b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.776] GetLastError () returned 0x0 [0058.776] GetCurrentProcessId () returned 0x13cc [0058.776] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4b4 [0058.776] GetLastError () returned 0x0 [0058.776] GetExitCodeProcess (in: hProcess=0x4b4, lpExitCode=0x265780c | out: lpExitCode=0x265780c*=0x103) returned 1 [0058.776] GetLastError () returned 0x0 [0058.779] CheckRemoteDebuggerPresent (in: hProcess=0x4b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.779] GetLastError () returned 0x0 [0058.779] GetCurrentProcessId () returned 0x13cc [0058.779] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4b8 [0058.779] GetLastError () returned 0x0 [0058.779] GetExitCodeProcess (in: hProcess=0x4b8, lpExitCode=0x26578c0 | out: lpExitCode=0x26578c0*=0x103) returned 1 [0058.779] GetLastError () returned 0x0 [0058.779] CheckRemoteDebuggerPresent (in: hProcess=0x4b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.779] GetLastError () returned 0x0 [0058.779] GetCurrentProcessId () returned 0x13cc [0058.779] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4bc [0058.779] GetLastError () returned 0x0 [0058.779] GetExitCodeProcess (in: hProcess=0x4bc, lpExitCode=0x2657974 | out: lpExitCode=0x2657974*=0x103) returned 1 [0058.779] GetLastError () returned 0x0 [0058.780] CheckRemoteDebuggerPresent (in: hProcess=0x4bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.780] GetLastError () returned 0x0 [0058.780] GetCurrentProcessId () returned 0x13cc [0058.780] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4c0 [0058.780] GetLastError () returned 0x0 [0058.780] GetExitCodeProcess (in: hProcess=0x4c0, lpExitCode=0x2657a28 | out: lpExitCode=0x2657a28*=0x103) returned 1 [0058.780] GetLastError () returned 0x0 [0058.780] CheckRemoteDebuggerPresent (in: hProcess=0x4c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.780] GetLastError () returned 0x0 [0058.780] GetCurrentProcessId () returned 0x13cc [0058.780] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4c4 [0058.780] GetLastError () returned 0x0 [0058.780] GetExitCodeProcess (in: hProcess=0x4c4, lpExitCode=0x2657adc | out: lpExitCode=0x2657adc*=0x103) returned 1 [0058.780] GetLastError () returned 0x0 [0058.780] CheckRemoteDebuggerPresent (in: hProcess=0x4c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.780] GetLastError () returned 0x0 [0058.780] GetCurrentProcessId () returned 0x13cc [0058.780] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4c8 [0058.780] GetLastError () returned 0x0 [0058.780] GetExitCodeProcess (in: hProcess=0x4c8, lpExitCode=0x2657b90 | out: lpExitCode=0x2657b90*=0x103) returned 1 [0058.781] GetLastError () returned 0x0 [0058.781] CheckRemoteDebuggerPresent (in: hProcess=0x4c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.781] GetLastError () returned 0x0 [0058.781] GetCurrentProcessId () returned 0x13cc [0058.781] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4cc [0058.781] GetLastError () returned 0x0 [0058.781] GetExitCodeProcess (in: hProcess=0x4cc, lpExitCode=0x2657c44 | out: lpExitCode=0x2657c44*=0x103) returned 1 [0058.781] GetLastError () returned 0x0 [0058.781] CheckRemoteDebuggerPresent (in: hProcess=0x4cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.781] GetLastError () returned 0x0 [0058.781] GetCurrentProcessId () returned 0x13cc [0058.781] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4d0 [0058.781] GetLastError () returned 0x0 [0058.781] GetExitCodeProcess (in: hProcess=0x4d0, lpExitCode=0x2657cf8 | out: lpExitCode=0x2657cf8*=0x103) returned 1 [0058.781] GetLastError () returned 0x0 [0058.781] CheckRemoteDebuggerPresent (in: hProcess=0x4d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.781] GetLastError () returned 0x0 [0058.782] GetCurrentProcessId () returned 0x13cc [0058.782] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4d4 [0058.782] GetLastError () returned 0x0 [0058.782] GetExitCodeProcess (in: hProcess=0x4d4, lpExitCode=0x2657dac | out: lpExitCode=0x2657dac*=0x103) returned 1 [0058.782] GetLastError () returned 0x0 [0058.782] CheckRemoteDebuggerPresent (in: hProcess=0x4d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.782] GetLastError () returned 0x0 [0058.782] GetCurrentProcessId () returned 0x13cc [0058.782] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4d8 [0058.782] GetLastError () returned 0x0 [0058.782] GetExitCodeProcess (in: hProcess=0x4d8, lpExitCode=0x2657e60 | out: lpExitCode=0x2657e60*=0x103) returned 1 [0058.782] GetLastError () returned 0x0 [0058.782] CheckRemoteDebuggerPresent (in: hProcess=0x4d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.782] GetLastError () returned 0x0 [0058.782] GetCurrentProcessId () returned 0x13cc [0058.782] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4dc [0058.782] GetLastError () returned 0x0 [0058.782] GetExitCodeProcess (in: hProcess=0x4dc, lpExitCode=0x2657f14 | out: lpExitCode=0x2657f14*=0x103) returned 1 [0058.783] GetLastError () returned 0x0 [0058.783] CheckRemoteDebuggerPresent (in: hProcess=0x4dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.783] GetLastError () returned 0x0 [0058.783] GetCurrentProcessId () returned 0x13cc [0058.783] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4e0 [0058.783] GetLastError () returned 0x0 [0058.783] GetExitCodeProcess (in: hProcess=0x4e0, lpExitCode=0x2657fc8 | out: lpExitCode=0x2657fc8*=0x103) returned 1 [0058.783] GetLastError () returned 0x0 [0058.783] CheckRemoteDebuggerPresent (in: hProcess=0x4e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.783] GetLastError () returned 0x0 [0058.783] GetCurrentProcessId () returned 0x13cc [0058.783] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4e4 [0058.783] GetLastError () returned 0x0 [0058.783] GetExitCodeProcess (in: hProcess=0x4e4, lpExitCode=0x265807c | out: lpExitCode=0x265807c*=0x103) returned 1 [0058.783] GetLastError () returned 0x0 [0058.784] CheckRemoteDebuggerPresent (in: hProcess=0x4e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.784] GetLastError () returned 0x0 [0058.784] GetCurrentProcessId () returned 0x13cc [0058.784] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4e8 [0058.784] GetLastError () returned 0x0 [0058.784] GetExitCodeProcess (in: hProcess=0x4e8, lpExitCode=0x2658130 | out: lpExitCode=0x2658130*=0x103) returned 1 [0058.784] GetLastError () returned 0x0 [0058.784] CheckRemoteDebuggerPresent (in: hProcess=0x4e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.784] GetLastError () returned 0x0 [0058.784] GetCurrentProcessId () returned 0x13cc [0058.784] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4ec [0058.784] GetLastError () returned 0x0 [0058.784] GetExitCodeProcess (in: hProcess=0x4ec, lpExitCode=0x26581e4 | out: lpExitCode=0x26581e4*=0x103) returned 1 [0058.784] GetLastError () returned 0x0 [0058.784] CheckRemoteDebuggerPresent (in: hProcess=0x4ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.784] GetLastError () returned 0x0 [0058.784] GetCurrentProcessId () returned 0x13cc [0058.784] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4f0 [0058.784] GetLastError () returned 0x0 [0058.784] GetExitCodeProcess (in: hProcess=0x4f0, lpExitCode=0x2658298 | out: lpExitCode=0x2658298*=0x103) returned 1 [0058.785] GetLastError () returned 0x0 [0058.785] CheckRemoteDebuggerPresent (in: hProcess=0x4f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.785] GetLastError () returned 0x0 [0058.785] GetCurrentProcessId () returned 0x13cc [0058.785] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4f4 [0058.785] GetLastError () returned 0x0 [0058.785] GetExitCodeProcess (in: hProcess=0x4f4, lpExitCode=0x265834c | out: lpExitCode=0x265834c*=0x103) returned 1 [0058.785] GetLastError () returned 0x0 [0058.785] CheckRemoteDebuggerPresent (in: hProcess=0x4f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.785] GetLastError () returned 0x0 [0058.785] GetCurrentProcessId () returned 0x13cc [0058.785] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4f8 [0058.785] GetLastError () returned 0x0 [0058.785] GetExitCodeProcess (in: hProcess=0x4f8, lpExitCode=0x2658400 | out: lpExitCode=0x2658400*=0x103) returned 1 [0058.785] GetLastError () returned 0x0 [0058.785] CheckRemoteDebuggerPresent (in: hProcess=0x4f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.785] GetLastError () returned 0x0 [0058.786] GetCurrentProcessId () returned 0x13cc [0058.786] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x4fc [0058.786] GetLastError () returned 0x0 [0058.786] GetExitCodeProcess (in: hProcess=0x4fc, lpExitCode=0x26584b4 | out: lpExitCode=0x26584b4*=0x103) returned 1 [0058.786] GetLastError () returned 0x0 [0058.786] CheckRemoteDebuggerPresent (in: hProcess=0x4fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.786] GetLastError () returned 0x0 [0058.786] GetCurrentProcessId () returned 0x13cc [0058.786] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x500 [0058.786] GetLastError () returned 0x0 [0058.786] GetExitCodeProcess (in: hProcess=0x500, lpExitCode=0x2658568 | out: lpExitCode=0x2658568*=0x103) returned 1 [0058.786] GetLastError () returned 0x0 [0058.786] CheckRemoteDebuggerPresent (in: hProcess=0x500, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.786] GetLastError () returned 0x0 [0058.786] GetCurrentProcessId () returned 0x13cc [0058.786] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x504 [0058.786] GetLastError () returned 0x0 [0058.786] GetExitCodeProcess (in: hProcess=0x504, lpExitCode=0x265861c | out: lpExitCode=0x265861c*=0x103) returned 1 [0058.786] GetLastError () returned 0x0 [0058.786] CheckRemoteDebuggerPresent (in: hProcess=0x504, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.787] GetLastError () returned 0x0 [0058.787] GetCurrentProcessId () returned 0x13cc [0058.787] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x508 [0058.787] GetLastError () returned 0x0 [0058.787] GetExitCodeProcess (in: hProcess=0x508, lpExitCode=0x26586d0 | out: lpExitCode=0x26586d0*=0x103) returned 1 [0058.787] GetLastError () returned 0x0 [0058.787] CheckRemoteDebuggerPresent (in: hProcess=0x508, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.787] GetLastError () returned 0x0 [0058.787] GetCurrentProcessId () returned 0x13cc [0058.787] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x50c [0058.787] GetLastError () returned 0x0 [0058.787] GetExitCodeProcess (in: hProcess=0x50c, lpExitCode=0x2658784 | out: lpExitCode=0x2658784*=0x103) returned 1 [0058.787] GetLastError () returned 0x0 [0058.787] CheckRemoteDebuggerPresent (in: hProcess=0x50c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.787] GetLastError () returned 0x0 [0058.787] GetCurrentProcessId () returned 0x13cc [0058.787] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x510 [0058.787] GetLastError () returned 0x0 [0058.787] GetExitCodeProcess (in: hProcess=0x510, lpExitCode=0x2658838 | out: lpExitCode=0x2658838*=0x103) returned 1 [0058.788] GetLastError () returned 0x0 [0058.788] CheckRemoteDebuggerPresent (in: hProcess=0x510, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.788] GetLastError () returned 0x0 [0058.788] GetCurrentProcessId () returned 0x13cc [0058.788] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x514 [0058.788] GetLastError () returned 0x0 [0058.788] GetExitCodeProcess (in: hProcess=0x514, lpExitCode=0x26588ec | out: lpExitCode=0x26588ec*=0x103) returned 1 [0058.788] GetLastError () returned 0x0 [0058.788] CheckRemoteDebuggerPresent (in: hProcess=0x514, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.788] GetLastError () returned 0x0 [0058.788] GetCurrentProcessId () returned 0x13cc [0058.788] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x518 [0058.788] GetLastError () returned 0x0 [0058.788] GetExitCodeProcess (in: hProcess=0x518, lpExitCode=0x26589a0 | out: lpExitCode=0x26589a0*=0x103) returned 1 [0058.788] GetLastError () returned 0x0 [0058.788] CheckRemoteDebuggerPresent (in: hProcess=0x518, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.788] GetLastError () returned 0x0 [0058.788] GetCurrentProcessId () returned 0x13cc [0058.788] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x51c [0058.788] GetLastError () returned 0x0 [0058.789] GetExitCodeProcess (in: hProcess=0x51c, lpExitCode=0x2658a54 | out: lpExitCode=0x2658a54*=0x103) returned 1 [0058.789] GetLastError () returned 0x0 [0058.789] CheckRemoteDebuggerPresent (in: hProcess=0x51c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.789] GetLastError () returned 0x0 [0058.789] GetCurrentProcessId () returned 0x13cc [0058.789] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x520 [0058.789] GetLastError () returned 0x0 [0058.789] GetExitCodeProcess (in: hProcess=0x520, lpExitCode=0x2658b08 | out: lpExitCode=0x2658b08*=0x103) returned 1 [0058.789] GetLastError () returned 0x0 [0058.789] CheckRemoteDebuggerPresent (in: hProcess=0x520, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.789] GetLastError () returned 0x0 [0058.789] GetCurrentProcessId () returned 0x13cc [0058.789] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x524 [0058.789] GetLastError () returned 0x0 [0058.789] GetExitCodeProcess (in: hProcess=0x524, lpExitCode=0x2658bbc | out: lpExitCode=0x2658bbc*=0x103) returned 1 [0058.789] GetLastError () returned 0x0 [0058.789] CheckRemoteDebuggerPresent (in: hProcess=0x524, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.789] GetLastError () returned 0x0 [0058.789] GetCurrentProcessId () returned 0x13cc [0058.790] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x528 [0058.790] GetLastError () returned 0x0 [0058.790] GetExitCodeProcess (in: hProcess=0x528, lpExitCode=0x2658c70 | out: lpExitCode=0x2658c70*=0x103) returned 1 [0058.790] GetLastError () returned 0x0 [0058.790] CheckRemoteDebuggerPresent (in: hProcess=0x528, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.790] GetLastError () returned 0x0 [0058.790] GetCurrentProcessId () returned 0x13cc [0058.790] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x52c [0058.790] GetLastError () returned 0x0 [0058.790] GetExitCodeProcess (in: hProcess=0x52c, lpExitCode=0x2658d24 | out: lpExitCode=0x2658d24*=0x103) returned 1 [0058.790] GetLastError () returned 0x0 [0058.790] CheckRemoteDebuggerPresent (in: hProcess=0x52c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.790] GetLastError () returned 0x0 [0058.790] GetCurrentProcessId () returned 0x13cc [0058.790] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x530 [0058.790] GetLastError () returned 0x0 [0058.790] GetExitCodeProcess (in: hProcess=0x530, lpExitCode=0x2658dd8 | out: lpExitCode=0x2658dd8*=0x103) returned 1 [0058.790] GetLastError () returned 0x0 [0058.790] CheckRemoteDebuggerPresent (in: hProcess=0x530, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.790] GetLastError () returned 0x0 [0058.791] GetCurrentProcessId () returned 0x13cc [0058.791] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x534 [0058.791] GetLastError () returned 0x0 [0058.791] GetExitCodeProcess (in: hProcess=0x534, lpExitCode=0x2658e8c | out: lpExitCode=0x2658e8c*=0x103) returned 1 [0058.791] GetLastError () returned 0x0 [0058.791] CheckRemoteDebuggerPresent (in: hProcess=0x534, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.791] GetLastError () returned 0x0 [0058.791] GetCurrentProcessId () returned 0x13cc [0058.791] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x538 [0058.791] GetLastError () returned 0x0 [0058.791] GetExitCodeProcess (in: hProcess=0x538, lpExitCode=0x2658f40 | out: lpExitCode=0x2658f40*=0x103) returned 1 [0058.791] GetLastError () returned 0x0 [0058.791] CheckRemoteDebuggerPresent (in: hProcess=0x538, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.791] GetLastError () returned 0x0 [0058.791] GetCurrentProcessId () returned 0x13cc [0058.791] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x53c [0058.791] GetLastError () returned 0x0 [0058.791] GetExitCodeProcess (in: hProcess=0x53c, lpExitCode=0x2658ff4 | out: lpExitCode=0x2658ff4*=0x103) returned 1 [0058.791] GetLastError () returned 0x0 [0058.791] CheckRemoteDebuggerPresent (in: hProcess=0x53c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.791] GetLastError () returned 0x0 [0058.792] GetCurrentProcessId () returned 0x13cc [0058.792] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x540 [0058.792] GetLastError () returned 0x0 [0058.792] GetExitCodeProcess (in: hProcess=0x540, lpExitCode=0x26590a8 | out: lpExitCode=0x26590a8*=0x103) returned 1 [0058.792] GetLastError () returned 0x0 [0058.792] CheckRemoteDebuggerPresent (in: hProcess=0x540, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.792] GetLastError () returned 0x0 [0058.792] GetCurrentProcessId () returned 0x13cc [0058.792] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x544 [0058.792] GetLastError () returned 0x0 [0058.792] GetExitCodeProcess (in: hProcess=0x544, lpExitCode=0x265915c | out: lpExitCode=0x265915c*=0x103) returned 1 [0058.792] GetLastError () returned 0x0 [0058.793] CheckRemoteDebuggerPresent (in: hProcess=0x544, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.793] GetLastError () returned 0x0 [0058.793] GetCurrentProcessId () returned 0x13cc [0058.793] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x548 [0058.793] GetLastError () returned 0x0 [0058.793] GetExitCodeProcess (in: hProcess=0x548, lpExitCode=0x2659210 | out: lpExitCode=0x2659210*=0x103) returned 1 [0058.793] GetLastError () returned 0x0 [0058.793] CheckRemoteDebuggerPresent (in: hProcess=0x548, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.793] GetLastError () returned 0x0 [0058.793] GetCurrentProcessId () returned 0x13cc [0058.793] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x54c [0058.793] GetLastError () returned 0x0 [0058.793] GetExitCodeProcess (in: hProcess=0x54c, lpExitCode=0x26592c4 | out: lpExitCode=0x26592c4*=0x103) returned 1 [0058.793] GetLastError () returned 0x0 [0058.793] CheckRemoteDebuggerPresent (in: hProcess=0x54c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.793] GetLastError () returned 0x0 [0058.793] GetCurrentProcessId () returned 0x13cc [0058.793] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x550 [0058.793] GetLastError () returned 0x0 [0058.793] GetExitCodeProcess (in: hProcess=0x550, lpExitCode=0x2659378 | out: lpExitCode=0x2659378*=0x103) returned 1 [0058.794] GetLastError () returned 0x0 [0058.794] CheckRemoteDebuggerPresent (in: hProcess=0x550, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.794] GetLastError () returned 0x0 [0058.794] GetCurrentProcessId () returned 0x13cc [0058.794] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x554 [0058.794] GetLastError () returned 0x0 [0058.794] GetExitCodeProcess (in: hProcess=0x554, lpExitCode=0x265942c | out: lpExitCode=0x265942c*=0x103) returned 1 [0058.794] GetLastError () returned 0x0 [0058.794] CheckRemoteDebuggerPresent (in: hProcess=0x554, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.794] GetLastError () returned 0x0 [0058.794] GetCurrentProcessId () returned 0x13cc [0058.794] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x558 [0058.794] GetLastError () returned 0x0 [0058.794] GetExitCodeProcess (in: hProcess=0x558, lpExitCode=0x26594e0 | out: lpExitCode=0x26594e0*=0x103) returned 1 [0058.794] GetLastError () returned 0x0 [0058.794] CheckRemoteDebuggerPresent (in: hProcess=0x558, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.794] GetLastError () returned 0x0 [0058.794] GetCurrentProcessId () returned 0x13cc [0058.795] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x55c [0058.795] GetLastError () returned 0x0 [0058.795] GetExitCodeProcess (in: hProcess=0x55c, lpExitCode=0x2659594 | out: lpExitCode=0x2659594*=0x103) returned 1 [0058.795] GetLastError () returned 0x0 [0058.795] CheckRemoteDebuggerPresent (in: hProcess=0x55c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.795] GetLastError () returned 0x0 [0058.795] GetCurrentProcessId () returned 0x13cc [0058.795] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x560 [0058.795] GetLastError () returned 0x0 [0058.795] GetExitCodeProcess (in: hProcess=0x560, lpExitCode=0x2659648 | out: lpExitCode=0x2659648*=0x103) returned 1 [0058.795] GetLastError () returned 0x0 [0058.795] CheckRemoteDebuggerPresent (in: hProcess=0x560, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.795] GetLastError () returned 0x0 [0058.795] GetCurrentProcessId () returned 0x13cc [0058.795] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x564 [0058.795] GetLastError () returned 0x0 [0058.795] GetExitCodeProcess (in: hProcess=0x564, lpExitCode=0x26596fc | out: lpExitCode=0x26596fc*=0x103) returned 1 [0058.795] GetLastError () returned 0x0 [0058.795] CheckRemoteDebuggerPresent (in: hProcess=0x564, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.796] GetLastError () returned 0x0 [0058.796] GetCurrentProcessId () returned 0x13cc [0058.796] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x568 [0058.796] GetLastError () returned 0x0 [0058.796] GetExitCodeProcess (in: hProcess=0x568, lpExitCode=0x26597b0 | out: lpExitCode=0x26597b0*=0x103) returned 1 [0058.796] GetLastError () returned 0x0 [0058.796] CheckRemoteDebuggerPresent (in: hProcess=0x568, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.796] GetLastError () returned 0x0 [0058.796] GetCurrentProcessId () returned 0x13cc [0058.796] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x56c [0058.796] GetLastError () returned 0x0 [0058.796] GetExitCodeProcess (in: hProcess=0x56c, lpExitCode=0x2659864 | out: lpExitCode=0x2659864*=0x103) returned 1 [0058.796] GetLastError () returned 0x0 [0058.796] CheckRemoteDebuggerPresent (in: hProcess=0x56c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.796] GetLastError () returned 0x0 [0058.796] GetCurrentProcessId () returned 0x13cc [0058.796] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x570 [0058.796] GetLastError () returned 0x0 [0058.797] GetExitCodeProcess (in: hProcess=0x570, lpExitCode=0x2659918 | out: lpExitCode=0x2659918*=0x103) returned 1 [0058.797] GetLastError () returned 0x0 [0058.797] CheckRemoteDebuggerPresent (in: hProcess=0x570, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.797] GetLastError () returned 0x0 [0058.797] GetCurrentProcessId () returned 0x13cc [0058.797] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x574 [0058.797] GetLastError () returned 0x0 [0058.797] GetExitCodeProcess (in: hProcess=0x574, lpExitCode=0x26599cc | out: lpExitCode=0x26599cc*=0x103) returned 1 [0058.797] GetLastError () returned 0x0 [0058.797] CheckRemoteDebuggerPresent (in: hProcess=0x574, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.797] GetLastError () returned 0x0 [0058.797] GetCurrentProcessId () returned 0x13cc [0058.797] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x578 [0058.797] GetLastError () returned 0x0 [0058.797] GetExitCodeProcess (in: hProcess=0x578, lpExitCode=0x2659a80 | out: lpExitCode=0x2659a80*=0x103) returned 1 [0058.797] GetLastError () returned 0x0 [0058.797] CheckRemoteDebuggerPresent (in: hProcess=0x578, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.797] GetLastError () returned 0x0 [0058.797] GetCurrentProcessId () returned 0x13cc [0058.797] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x57c [0058.798] GetLastError () returned 0x0 [0058.798] GetExitCodeProcess (in: hProcess=0x57c, lpExitCode=0x2659b34 | out: lpExitCode=0x2659b34*=0x103) returned 1 [0058.798] GetLastError () returned 0x0 [0058.798] CheckRemoteDebuggerPresent (in: hProcess=0x57c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.798] GetLastError () returned 0x0 [0058.798] GetCurrentProcessId () returned 0x13cc [0058.798] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x580 [0058.798] GetLastError () returned 0x0 [0058.798] GetExitCodeProcess (in: hProcess=0x580, lpExitCode=0x2659be8 | out: lpExitCode=0x2659be8*=0x103) returned 1 [0058.798] GetLastError () returned 0x0 [0058.798] CheckRemoteDebuggerPresent (in: hProcess=0x580, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.798] GetLastError () returned 0x0 [0058.798] GetCurrentProcessId () returned 0x13cc [0058.798] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x584 [0058.798] GetLastError () returned 0x0 [0058.798] GetExitCodeProcess (in: hProcess=0x584, lpExitCode=0x2659c9c | out: lpExitCode=0x2659c9c*=0x103) returned 1 [0058.798] GetLastError () returned 0x0 [0058.798] CheckRemoteDebuggerPresent (in: hProcess=0x584, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.798] GetLastError () returned 0x0 [0058.799] GetCurrentProcessId () returned 0x13cc [0058.799] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x588 [0058.799] GetLastError () returned 0x0 [0058.799] GetExitCodeProcess (in: hProcess=0x588, lpExitCode=0x2659d50 | out: lpExitCode=0x2659d50*=0x103) returned 1 [0058.799] GetLastError () returned 0x0 [0058.799] CheckRemoteDebuggerPresent (in: hProcess=0x588, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.799] GetLastError () returned 0x0 [0058.799] GetCurrentProcessId () returned 0x13cc [0058.799] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x58c [0058.799] GetLastError () returned 0x0 [0058.799] GetExitCodeProcess (in: hProcess=0x58c, lpExitCode=0x2659e04 | out: lpExitCode=0x2659e04*=0x103) returned 1 [0058.799] GetLastError () returned 0x0 [0058.799] CheckRemoteDebuggerPresent (in: hProcess=0x58c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.799] GetLastError () returned 0x0 [0058.799] GetCurrentProcessId () returned 0x13cc [0058.799] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x590 [0058.799] GetLastError () returned 0x0 [0058.799] GetExitCodeProcess (in: hProcess=0x590, lpExitCode=0x2659eb8 | out: lpExitCode=0x2659eb8*=0x103) returned 1 [0058.799] GetLastError () returned 0x0 [0058.800] CheckRemoteDebuggerPresent (in: hProcess=0x590, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.800] GetLastError () returned 0x0 [0058.800] GetCurrentProcessId () returned 0x13cc [0058.800] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x594 [0058.800] GetLastError () returned 0x0 [0058.800] GetExitCodeProcess (in: hProcess=0x594, lpExitCode=0x2659f6c | out: lpExitCode=0x2659f6c*=0x103) returned 1 [0058.800] GetLastError () returned 0x0 [0058.800] CheckRemoteDebuggerPresent (in: hProcess=0x594, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.800] GetLastError () returned 0x0 [0058.800] GetCurrentProcessId () returned 0x13cc [0058.800] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x598 [0058.800] GetLastError () returned 0x0 [0058.800] GetExitCodeProcess (in: hProcess=0x598, lpExitCode=0x265a020 | out: lpExitCode=0x265a020*=0x103) returned 1 [0058.800] GetLastError () returned 0x0 [0058.800] CheckRemoteDebuggerPresent (in: hProcess=0x598, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.800] GetLastError () returned 0x0 [0058.800] GetCurrentProcessId () returned 0x13cc [0058.801] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x59c [0058.801] GetLastError () returned 0x0 [0058.801] GetExitCodeProcess (in: hProcess=0x59c, lpExitCode=0x265a0d4 | out: lpExitCode=0x265a0d4*=0x103) returned 1 [0058.801] GetLastError () returned 0x0 [0058.801] CheckRemoteDebuggerPresent (in: hProcess=0x59c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.801] GetLastError () returned 0x0 [0058.801] GetCurrentProcessId () returned 0x13cc [0058.801] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5a0 [0058.801] GetLastError () returned 0x0 [0058.801] GetExitCodeProcess (in: hProcess=0x5a0, lpExitCode=0x265a188 | out: lpExitCode=0x265a188*=0x103) returned 1 [0058.801] GetLastError () returned 0x0 [0058.801] CheckRemoteDebuggerPresent (in: hProcess=0x5a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.801] GetLastError () returned 0x0 [0058.801] GetCurrentProcessId () returned 0x13cc [0058.801] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5a4 [0058.801] GetLastError () returned 0x0 [0058.801] GetExitCodeProcess (in: hProcess=0x5a4, lpExitCode=0x265a23c | out: lpExitCode=0x265a23c*=0x103) returned 1 [0058.801] GetLastError () returned 0x0 [0058.801] CheckRemoteDebuggerPresent (in: hProcess=0x5a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.801] GetLastError () returned 0x0 [0058.802] GetCurrentProcessId () returned 0x13cc [0058.802] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5a8 [0058.802] GetLastError () returned 0x0 [0058.802] GetExitCodeProcess (in: hProcess=0x5a8, lpExitCode=0x265a2f0 | out: lpExitCode=0x265a2f0*=0x103) returned 1 [0058.802] GetLastError () returned 0x0 [0058.802] CheckRemoteDebuggerPresent (in: hProcess=0x5a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.802] GetLastError () returned 0x0 [0058.802] GetCurrentProcessId () returned 0x13cc [0058.802] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5ac [0058.802] GetLastError () returned 0x0 [0058.802] GetExitCodeProcess (in: hProcess=0x5ac, lpExitCode=0x265a3a4 | out: lpExitCode=0x265a3a4*=0x103) returned 1 [0058.802] GetLastError () returned 0x0 [0058.802] CheckRemoteDebuggerPresent (in: hProcess=0x5ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.802] GetLastError () returned 0x0 [0058.802] GetCurrentProcessId () returned 0x13cc [0058.802] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5b0 [0058.802] GetLastError () returned 0x0 [0058.802] GetExitCodeProcess (in: hProcess=0x5b0, lpExitCode=0x265a458 | out: lpExitCode=0x265a458*=0x103) returned 1 [0058.802] GetLastError () returned 0x0 [0058.803] CheckRemoteDebuggerPresent (in: hProcess=0x5b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.803] GetLastError () returned 0x0 [0058.803] GetCurrentProcessId () returned 0x13cc [0058.803] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5b4 [0058.803] GetLastError () returned 0x0 [0058.803] GetExitCodeProcess (in: hProcess=0x5b4, lpExitCode=0x265a50c | out: lpExitCode=0x265a50c*=0x103) returned 1 [0058.803] GetLastError () returned 0x0 [0058.803] CheckRemoteDebuggerPresent (in: hProcess=0x5b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.803] GetLastError () returned 0x0 [0058.803] GetCurrentProcessId () returned 0x13cc [0058.803] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5b8 [0058.803] GetLastError () returned 0x0 [0058.803] GetExitCodeProcess (in: hProcess=0x5b8, lpExitCode=0x265a5c0 | out: lpExitCode=0x265a5c0*=0x103) returned 1 [0058.803] GetLastError () returned 0x0 [0058.803] CheckRemoteDebuggerPresent (in: hProcess=0x5b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.803] GetLastError () returned 0x0 [0058.803] GetCurrentProcessId () returned 0x13cc [0058.803] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5bc [0058.803] GetLastError () returned 0x0 [0058.803] GetExitCodeProcess (in: hProcess=0x5bc, lpExitCode=0x265a674 | out: lpExitCode=0x265a674*=0x103) returned 1 [0058.804] GetLastError () returned 0x0 [0058.804] CheckRemoteDebuggerPresent (in: hProcess=0x5bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.804] GetLastError () returned 0x0 [0058.804] GetCurrentProcessId () returned 0x13cc [0058.804] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5c0 [0058.804] GetLastError () returned 0x0 [0058.804] GetExitCodeProcess (in: hProcess=0x5c0, lpExitCode=0x265a728 | out: lpExitCode=0x265a728*=0x103) returned 1 [0058.804] GetLastError () returned 0x0 [0058.804] CheckRemoteDebuggerPresent (in: hProcess=0x5c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.804] GetLastError () returned 0x0 [0058.804] GetCurrentProcessId () returned 0x13cc [0058.804] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5c4 [0058.804] GetLastError () returned 0x0 [0058.804] GetExitCodeProcess (in: hProcess=0x5c4, lpExitCode=0x265a7dc | out: lpExitCode=0x265a7dc*=0x103) returned 1 [0058.804] GetLastError () returned 0x0 [0058.804] CheckRemoteDebuggerPresent (in: hProcess=0x5c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.804] GetLastError () returned 0x0 [0058.804] GetCurrentProcessId () returned 0x13cc [0058.804] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5c8 [0058.805] GetLastError () returned 0x0 [0058.805] GetExitCodeProcess (in: hProcess=0x5c8, lpExitCode=0x265a890 | out: lpExitCode=0x265a890*=0x103) returned 1 [0058.805] GetLastError () returned 0x0 [0058.805] CheckRemoteDebuggerPresent (in: hProcess=0x5c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.805] GetLastError () returned 0x0 [0058.805] GetCurrentProcessId () returned 0x13cc [0058.805] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5cc [0058.805] GetLastError () returned 0x0 [0058.805] GetExitCodeProcess (in: hProcess=0x5cc, lpExitCode=0x265a944 | out: lpExitCode=0x265a944*=0x103) returned 1 [0058.805] GetLastError () returned 0x0 [0058.805] CheckRemoteDebuggerPresent (in: hProcess=0x5cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.805] GetLastError () returned 0x0 [0058.805] GetCurrentProcessId () returned 0x13cc [0058.805] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5d0 [0058.805] GetLastError () returned 0x0 [0058.805] GetExitCodeProcess (in: hProcess=0x5d0, lpExitCode=0x265a9f8 | out: lpExitCode=0x265a9f8*=0x103) returned 1 [0058.805] GetLastError () returned 0x0 [0058.805] CheckRemoteDebuggerPresent (in: hProcess=0x5d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.805] GetLastError () returned 0x0 [0058.806] GetCurrentProcessId () returned 0x13cc [0058.806] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5d4 [0058.806] GetLastError () returned 0x0 [0058.806] GetExitCodeProcess (in: hProcess=0x5d4, lpExitCode=0x265aaac | out: lpExitCode=0x265aaac*=0x103) returned 1 [0058.806] GetLastError () returned 0x0 [0058.806] CheckRemoteDebuggerPresent (in: hProcess=0x5d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.806] GetLastError () returned 0x0 [0058.806] GetCurrentProcessId () returned 0x13cc [0058.806] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5d8 [0058.806] GetLastError () returned 0x0 [0058.806] GetExitCodeProcess (in: hProcess=0x5d8, lpExitCode=0x265ab60 | out: lpExitCode=0x265ab60*=0x103) returned 1 [0058.806] GetLastError () returned 0x0 [0058.806] CheckRemoteDebuggerPresent (in: hProcess=0x5d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.806] GetLastError () returned 0x0 [0058.806] GetCurrentProcessId () returned 0x13cc [0058.806] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5dc [0058.806] GetLastError () returned 0x0 [0058.806] GetExitCodeProcess (in: hProcess=0x5dc, lpExitCode=0x265ac14 | out: lpExitCode=0x265ac14*=0x103) returned 1 [0058.807] GetLastError () returned 0x0 [0058.807] CheckRemoteDebuggerPresent (in: hProcess=0x5dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.807] GetLastError () returned 0x0 [0058.807] GetCurrentProcessId () returned 0x13cc [0058.807] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5e0 [0058.807] GetLastError () returned 0x0 [0058.807] GetExitCodeProcess (in: hProcess=0x5e0, lpExitCode=0x265acc8 | out: lpExitCode=0x265acc8*=0x103) returned 1 [0058.807] GetLastError () returned 0x0 [0058.807] CheckRemoteDebuggerPresent (in: hProcess=0x5e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.807] GetLastError () returned 0x0 [0058.807] GetCurrentProcessId () returned 0x13cc [0058.807] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5e4 [0058.807] GetLastError () returned 0x0 [0058.807] GetExitCodeProcess (in: hProcess=0x5e4, lpExitCode=0x265ad7c | out: lpExitCode=0x265ad7c*=0x103) returned 1 [0058.807] GetLastError () returned 0x0 [0058.807] CheckRemoteDebuggerPresent (in: hProcess=0x5e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.807] GetLastError () returned 0x0 [0058.807] GetCurrentProcessId () returned 0x13cc [0058.807] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5e8 [0058.807] GetLastError () returned 0x0 [0058.807] GetExitCodeProcess (in: hProcess=0x5e8, lpExitCode=0x265ae30 | out: lpExitCode=0x265ae30*=0x103) returned 1 [0058.808] GetLastError () returned 0x0 [0058.808] CheckRemoteDebuggerPresent (in: hProcess=0x5e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.808] GetLastError () returned 0x0 [0058.808] GetCurrentProcessId () returned 0x13cc [0058.808] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5ec [0058.808] GetLastError () returned 0x0 [0058.808] GetExitCodeProcess (in: hProcess=0x5ec, lpExitCode=0x265aee4 | out: lpExitCode=0x265aee4*=0x103) returned 1 [0058.808] GetLastError () returned 0x0 [0058.808] CheckRemoteDebuggerPresent (in: hProcess=0x5ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.808] GetLastError () returned 0x0 [0058.808] GetCurrentProcessId () returned 0x13cc [0058.808] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5f0 [0058.808] GetLastError () returned 0x0 [0058.808] GetExitCodeProcess (in: hProcess=0x5f0, lpExitCode=0x265af98 | out: lpExitCode=0x265af98*=0x103) returned 1 [0058.809] GetLastError () returned 0x0 [0058.809] CheckRemoteDebuggerPresent (in: hProcess=0x5f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.809] GetLastError () returned 0x0 [0058.809] GetCurrentProcessId () returned 0x13cc [0058.809] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5f4 [0058.809] GetLastError () returned 0x0 [0058.809] GetExitCodeProcess (in: hProcess=0x5f4, lpExitCode=0x265b04c | out: lpExitCode=0x265b04c*=0x103) returned 1 [0058.809] GetLastError () returned 0x0 [0058.809] CheckRemoteDebuggerPresent (in: hProcess=0x5f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.809] GetLastError () returned 0x0 [0058.809] GetCurrentProcessId () returned 0x13cc [0058.809] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5f8 [0058.809] GetLastError () returned 0x0 [0058.809] GetExitCodeProcess (in: hProcess=0x5f8, lpExitCode=0x265b100 | out: lpExitCode=0x265b100*=0x103) returned 1 [0058.809] GetLastError () returned 0x0 [0058.809] CheckRemoteDebuggerPresent (in: hProcess=0x5f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.809] GetLastError () returned 0x0 [0058.809] GetCurrentProcessId () returned 0x13cc [0058.809] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x5fc [0058.809] GetLastError () returned 0x0 [0058.810] GetExitCodeProcess (in: hProcess=0x5fc, lpExitCode=0x265b1b4 | out: lpExitCode=0x265b1b4*=0x103) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] CheckRemoteDebuggerPresent (in: hProcess=0x5fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] GetCurrentProcessId () returned 0x13cc [0058.810] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x600 [0058.810] GetLastError () returned 0x0 [0058.810] GetExitCodeProcess (in: hProcess=0x600, lpExitCode=0x265b268 | out: lpExitCode=0x265b268*=0x103) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] CheckRemoteDebuggerPresent (in: hProcess=0x600, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] GetCurrentProcessId () returned 0x13cc [0058.810] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x604 [0058.810] GetLastError () returned 0x0 [0058.810] GetExitCodeProcess (in: hProcess=0x604, lpExitCode=0x265b31c | out: lpExitCode=0x265b31c*=0x103) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] CheckRemoteDebuggerPresent (in: hProcess=0x604, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] GetCurrentProcessId () returned 0x13cc [0058.811] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x608 [0058.811] GetLastError () returned 0x0 [0058.811] GetExitCodeProcess (in: hProcess=0x608, lpExitCode=0x265b3d0 | out: lpExitCode=0x265b3d0*=0x103) returned 1 [0058.811] GetLastError () returned 0x0 [0058.811] CheckRemoteDebuggerPresent (in: hProcess=0x608, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.811] GetLastError () returned 0x0 [0058.811] GetCurrentProcessId () returned 0x13cc [0058.811] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x60c [0058.811] GetLastError () returned 0x0 [0058.811] GetExitCodeProcess (in: hProcess=0x60c, lpExitCode=0x265b484 | out: lpExitCode=0x265b484*=0x103) returned 1 [0058.811] GetLastError () returned 0x0 [0058.811] CheckRemoteDebuggerPresent (in: hProcess=0x60c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.811] GetLastError () returned 0x0 [0058.811] GetCurrentProcessId () returned 0x13cc [0058.811] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x610 [0058.811] GetLastError () returned 0x0 [0058.811] GetExitCodeProcess (in: hProcess=0x610, lpExitCode=0x265b538 | out: lpExitCode=0x265b538*=0x103) returned 1 [0058.811] GetLastError () returned 0x0 [0058.811] CheckRemoteDebuggerPresent (in: hProcess=0x610, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.811] GetLastError () returned 0x0 [0058.812] GetCurrentProcessId () returned 0x13cc [0058.812] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x614 [0058.812] GetLastError () returned 0x0 [0058.812] GetExitCodeProcess (in: hProcess=0x614, lpExitCode=0x265b5ec | out: lpExitCode=0x265b5ec*=0x103) returned 1 [0058.812] GetLastError () returned 0x0 [0058.812] CheckRemoteDebuggerPresent (in: hProcess=0x614, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.812] GetLastError () returned 0x0 [0058.812] GetCurrentProcessId () returned 0x13cc [0058.812] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x618 [0058.812] GetLastError () returned 0x0 [0058.812] GetExitCodeProcess (in: hProcess=0x618, lpExitCode=0x265b6a0 | out: lpExitCode=0x265b6a0*=0x103) returned 1 [0058.812] GetLastError () returned 0x0 [0058.812] CheckRemoteDebuggerPresent (in: hProcess=0x618, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.812] GetLastError () returned 0x0 [0058.812] GetCurrentProcessId () returned 0x13cc [0058.812] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x61c [0058.812] GetLastError () returned 0x0 [0058.812] GetExitCodeProcess (in: hProcess=0x61c, lpExitCode=0x265b754 | out: lpExitCode=0x265b754*=0x103) returned 1 [0058.813] GetLastError () returned 0x0 [0058.813] CheckRemoteDebuggerPresent (in: hProcess=0x61c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.813] GetLastError () returned 0x0 [0058.813] GetCurrentProcessId () returned 0x13cc [0058.813] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x620 [0058.813] GetLastError () returned 0x0 [0058.813] GetExitCodeProcess (in: hProcess=0x620, lpExitCode=0x265b808 | out: lpExitCode=0x265b808*=0x103) returned 1 [0058.813] GetLastError () returned 0x0 [0058.813] CheckRemoteDebuggerPresent (in: hProcess=0x620, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.813] GetLastError () returned 0x0 [0058.813] GetCurrentProcessId () returned 0x13cc [0058.813] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x624 [0058.813] GetLastError () returned 0x0 [0058.813] GetExitCodeProcess (in: hProcess=0x624, lpExitCode=0x265b8bc | out: lpExitCode=0x265b8bc*=0x103) returned 1 [0058.813] GetLastError () returned 0x0 [0058.813] CheckRemoteDebuggerPresent (in: hProcess=0x624, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.813] GetLastError () returned 0x0 [0058.813] GetCurrentProcessId () returned 0x13cc [0058.814] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x628 [0058.814] GetLastError () returned 0x0 [0058.814] GetExitCodeProcess (in: hProcess=0x628, lpExitCode=0x265b970 | out: lpExitCode=0x265b970*=0x103) returned 1 [0058.814] GetLastError () returned 0x0 [0058.814] CheckRemoteDebuggerPresent (in: hProcess=0x628, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.814] GetLastError () returned 0x0 [0058.814] GetCurrentProcessId () returned 0x13cc [0058.814] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x62c [0058.814] GetLastError () returned 0x0 [0058.814] GetExitCodeProcess (in: hProcess=0x62c, lpExitCode=0x265ba24 | out: lpExitCode=0x265ba24*=0x103) returned 1 [0058.814] GetLastError () returned 0x0 [0058.814] CheckRemoteDebuggerPresent (in: hProcess=0x62c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.814] GetLastError () returned 0x0 [0058.814] GetCurrentProcessId () returned 0x13cc [0058.814] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x630 [0058.814] GetLastError () returned 0x0 [0058.814] GetExitCodeProcess (in: hProcess=0x630, lpExitCode=0x265bad8 | out: lpExitCode=0x265bad8*=0x103) returned 1 [0058.814] GetLastError () returned 0x0 [0058.815] CheckRemoteDebuggerPresent (in: hProcess=0x630, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.815] GetLastError () returned 0x0 [0058.815] GetCurrentProcessId () returned 0x13cc [0058.815] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x634 [0058.815] GetLastError () returned 0x0 [0058.815] GetExitCodeProcess (in: hProcess=0x634, lpExitCode=0x265bb8c | out: lpExitCode=0x265bb8c*=0x103) returned 1 [0058.815] GetLastError () returned 0x0 [0058.815] CheckRemoteDebuggerPresent (in: hProcess=0x634, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.815] GetLastError () returned 0x0 [0058.815] GetCurrentProcessId () returned 0x13cc [0058.815] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x638 [0058.815] GetLastError () returned 0x0 [0058.815] GetExitCodeProcess (in: hProcess=0x638, lpExitCode=0x265bc40 | out: lpExitCode=0x265bc40*=0x103) returned 1 [0058.815] GetLastError () returned 0x0 [0058.815] CheckRemoteDebuggerPresent (in: hProcess=0x638, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.815] GetLastError () returned 0x0 [0058.815] GetCurrentProcessId () returned 0x13cc [0058.816] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x63c [0058.816] GetLastError () returned 0x0 [0058.816] GetExitCodeProcess (in: hProcess=0x63c, lpExitCode=0x265bcf4 | out: lpExitCode=0x265bcf4*=0x103) returned 1 [0058.816] GetLastError () returned 0x0 [0058.816] CheckRemoteDebuggerPresent (in: hProcess=0x63c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.816] GetLastError () returned 0x0 [0058.816] GetCurrentProcessId () returned 0x13cc [0058.816] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x640 [0058.816] GetLastError () returned 0x0 [0058.816] GetExitCodeProcess (in: hProcess=0x640, lpExitCode=0x265bda8 | out: lpExitCode=0x265bda8*=0x103) returned 1 [0058.816] GetLastError () returned 0x0 [0058.816] CheckRemoteDebuggerPresent (in: hProcess=0x640, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.816] GetLastError () returned 0x0 [0058.816] GetCurrentProcessId () returned 0x13cc [0058.816] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x644 [0058.816] GetLastError () returned 0x0 [0058.816] GetExitCodeProcess (in: hProcess=0x644, lpExitCode=0x265be5c | out: lpExitCode=0x265be5c*=0x103) returned 1 [0058.816] GetLastError () returned 0x0 [0058.816] CheckRemoteDebuggerPresent (in: hProcess=0x644, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.817] GetLastError () returned 0x0 [0058.817] GetCurrentProcessId () returned 0x13cc [0058.817] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x648 [0058.817] GetLastError () returned 0x0 [0058.817] GetExitCodeProcess (in: hProcess=0x648, lpExitCode=0x265bf10 | out: lpExitCode=0x265bf10*=0x103) returned 1 [0058.817] GetLastError () returned 0x0 [0058.817] CheckRemoteDebuggerPresent (in: hProcess=0x648, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.817] GetLastError () returned 0x0 [0058.817] GetCurrentProcessId () returned 0x13cc [0058.817] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x64c [0058.817] GetLastError () returned 0x0 [0058.817] GetExitCodeProcess (in: hProcess=0x64c, lpExitCode=0x265bfc4 | out: lpExitCode=0x265bfc4*=0x103) returned 1 [0058.817] GetLastError () returned 0x0 [0058.817] CheckRemoteDebuggerPresent (in: hProcess=0x64c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.817] GetLastError () returned 0x0 [0058.818] GetCurrentProcessId () returned 0x13cc [0058.818] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x650 [0058.818] GetLastError () returned 0x0 [0058.818] GetExitCodeProcess (in: hProcess=0x650, lpExitCode=0x265c078 | out: lpExitCode=0x265c078*=0x103) returned 1 [0058.818] GetLastError () returned 0x0 [0058.818] CheckRemoteDebuggerPresent (in: hProcess=0x650, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.818] GetLastError () returned 0x0 [0058.818] GetCurrentProcessId () returned 0x13cc [0058.818] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x654 [0058.818] GetLastError () returned 0x0 [0058.818] GetExitCodeProcess (in: hProcess=0x654, lpExitCode=0x265c12c | out: lpExitCode=0x265c12c*=0x103) returned 1 [0058.818] GetLastError () returned 0x0 [0058.818] CheckRemoteDebuggerPresent (in: hProcess=0x654, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.818] GetLastError () returned 0x0 [0058.818] GetCurrentProcessId () returned 0x13cc [0058.818] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x658 [0058.818] GetLastError () returned 0x0 [0058.819] GetExitCodeProcess (in: hProcess=0x658, lpExitCode=0x265c1e0 | out: lpExitCode=0x265c1e0*=0x103) returned 1 [0058.819] GetLastError () returned 0x0 [0058.819] CheckRemoteDebuggerPresent (in: hProcess=0x658, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.819] GetLastError () returned 0x0 [0058.819] GetCurrentProcessId () returned 0x13cc [0058.819] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x65c [0058.819] GetLastError () returned 0x0 [0058.819] GetExitCodeProcess (in: hProcess=0x65c, lpExitCode=0x265c294 | out: lpExitCode=0x265c294*=0x103) returned 1 [0058.819] GetLastError () returned 0x0 [0058.819] CheckRemoteDebuggerPresent (in: hProcess=0x65c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.819] GetLastError () returned 0x0 [0058.819] GetCurrentProcessId () returned 0x13cc [0058.819] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x660 [0058.819] GetLastError () returned 0x0 [0058.819] GetExitCodeProcess (in: hProcess=0x660, lpExitCode=0x265c348 | out: lpExitCode=0x265c348*=0x103) returned 1 [0058.819] GetLastError () returned 0x0 [0058.820] CheckRemoteDebuggerPresent (in: hProcess=0x660, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.820] GetLastError () returned 0x0 [0058.820] GetCurrentProcessId () returned 0x13cc [0058.820] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x664 [0058.820] GetLastError () returned 0x0 [0058.820] GetExitCodeProcess (in: hProcess=0x664, lpExitCode=0x265c3fc | out: lpExitCode=0x265c3fc*=0x103) returned 1 [0058.820] GetLastError () returned 0x0 [0058.820] CheckRemoteDebuggerPresent (in: hProcess=0x664, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.820] GetLastError () returned 0x0 [0058.820] GetCurrentProcessId () returned 0x13cc [0058.820] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x668 [0058.820] GetLastError () returned 0x0 [0058.820] GetExitCodeProcess (in: hProcess=0x668, lpExitCode=0x265c4b0 | out: lpExitCode=0x265c4b0*=0x103) returned 1 [0058.820] GetLastError () returned 0x0 [0058.820] CheckRemoteDebuggerPresent (in: hProcess=0x668, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.820] GetLastError () returned 0x0 [0058.820] GetCurrentProcessId () returned 0x13cc [0058.820] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x66c [0058.820] GetLastError () returned 0x0 [0058.821] GetExitCodeProcess (in: hProcess=0x66c, lpExitCode=0x265c564 | out: lpExitCode=0x265c564*=0x103) returned 1 [0058.821] GetLastError () returned 0x0 [0058.821] CheckRemoteDebuggerPresent (in: hProcess=0x66c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.821] GetLastError () returned 0x0 [0058.821] GetCurrentProcessId () returned 0x13cc [0058.821] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x670 [0058.821] GetLastError () returned 0x0 [0058.821] GetExitCodeProcess (in: hProcess=0x670, lpExitCode=0x265c618 | out: lpExitCode=0x265c618*=0x103) returned 1 [0058.821] GetLastError () returned 0x0 [0058.821] CheckRemoteDebuggerPresent (in: hProcess=0x670, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.821] GetLastError () returned 0x0 [0058.821] GetCurrentProcessId () returned 0x13cc [0058.821] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x674 [0058.821] GetLastError () returned 0x0 [0058.821] GetExitCodeProcess (in: hProcess=0x674, lpExitCode=0x265c6cc | out: lpExitCode=0x265c6cc*=0x103) returned 1 [0058.821] GetLastError () returned 0x0 [0058.821] CheckRemoteDebuggerPresent (in: hProcess=0x674, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.821] GetLastError () returned 0x0 [0058.822] GetCurrentProcessId () returned 0x13cc [0058.822] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x678 [0058.822] GetLastError () returned 0x0 [0058.822] GetExitCodeProcess (in: hProcess=0x678, lpExitCode=0x265c780 | out: lpExitCode=0x265c780*=0x103) returned 1 [0058.822] GetLastError () returned 0x0 [0058.822] CheckRemoteDebuggerPresent (in: hProcess=0x678, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.822] GetLastError () returned 0x0 [0058.822] GetCurrentProcessId () returned 0x13cc [0058.822] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x67c [0058.822] GetLastError () returned 0x0 [0058.822] GetExitCodeProcess (in: hProcess=0x67c, lpExitCode=0x265c834 | out: lpExitCode=0x265c834*=0x103) returned 1 [0058.822] GetLastError () returned 0x0 [0058.822] CheckRemoteDebuggerPresent (in: hProcess=0x67c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.822] GetLastError () returned 0x0 [0058.822] GetCurrentProcessId () returned 0x13cc [0058.822] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x680 [0058.822] GetLastError () returned 0x0 [0058.822] GetExitCodeProcess (in: hProcess=0x680, lpExitCode=0x265c8e8 | out: lpExitCode=0x265c8e8*=0x103) returned 1 [0058.822] GetLastError () returned 0x0 [0058.823] CheckRemoteDebuggerPresent (in: hProcess=0x680, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.823] GetLastError () returned 0x0 [0058.823] GetCurrentProcessId () returned 0x13cc [0058.823] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x684 [0058.823] GetLastError () returned 0x0 [0058.823] GetExitCodeProcess (in: hProcess=0x684, lpExitCode=0x265c99c | out: lpExitCode=0x265c99c*=0x103) returned 1 [0058.823] GetLastError () returned 0x0 [0058.823] CheckRemoteDebuggerPresent (in: hProcess=0x684, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.823] GetLastError () returned 0x0 [0058.823] GetCurrentProcessId () returned 0x13cc [0058.823] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x688 [0058.823] GetLastError () returned 0x0 [0058.823] GetExitCodeProcess (in: hProcess=0x688, lpExitCode=0x265ca50 | out: lpExitCode=0x265ca50*=0x103) returned 1 [0058.823] GetLastError () returned 0x0 [0058.823] CheckRemoteDebuggerPresent (in: hProcess=0x688, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.823] GetLastError () returned 0x0 [0058.823] GetCurrentProcessId () returned 0x13cc [0058.823] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x68c [0058.824] GetLastError () returned 0x0 [0058.824] GetExitCodeProcess (in: hProcess=0x68c, lpExitCode=0x265cb04 | out: lpExitCode=0x265cb04*=0x103) returned 1 [0058.824] GetLastError () returned 0x0 [0058.824] CheckRemoteDebuggerPresent (in: hProcess=0x68c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.824] GetLastError () returned 0x0 [0058.824] GetCurrentProcessId () returned 0x13cc [0058.824] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x690 [0058.824] GetLastError () returned 0x0 [0058.824] GetExitCodeProcess (in: hProcess=0x690, lpExitCode=0x265cbb8 | out: lpExitCode=0x265cbb8*=0x103) returned 1 [0058.824] GetLastError () returned 0x0 [0058.824] CheckRemoteDebuggerPresent (in: hProcess=0x690, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.824] GetLastError () returned 0x0 [0058.826] GetCurrentProcessId () returned 0x13cc [0058.826] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x694 [0058.826] GetLastError () returned 0x0 [0058.827] GetExitCodeProcess (in: hProcess=0x694, lpExitCode=0x265cc6c | out: lpExitCode=0x265cc6c*=0x103) returned 1 [0058.827] GetLastError () returned 0x0 [0058.827] CheckRemoteDebuggerPresent (in: hProcess=0x694, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.827] GetLastError () returned 0x0 [0058.827] GetCurrentProcessId () returned 0x13cc [0058.827] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x698 [0058.827] GetLastError () returned 0x0 [0058.827] GetExitCodeProcess (in: hProcess=0x698, lpExitCode=0x265cd20 | out: lpExitCode=0x265cd20*=0x103) returned 1 [0058.827] GetLastError () returned 0x0 [0058.827] CheckRemoteDebuggerPresent (in: hProcess=0x698, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.827] GetLastError () returned 0x0 [0058.827] GetCurrentProcessId () returned 0x13cc [0058.827] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x69c [0058.827] GetLastError () returned 0x0 [0058.827] GetExitCodeProcess (in: hProcess=0x69c, lpExitCode=0x265cdd4 | out: lpExitCode=0x265cdd4*=0x103) returned 1 [0058.827] GetLastError () returned 0x0 [0058.827] CheckRemoteDebuggerPresent (in: hProcess=0x69c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.827] GetLastError () returned 0x0 [0058.828] GetCurrentProcessId () returned 0x13cc [0058.828] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6a0 [0058.828] GetLastError () returned 0x0 [0058.828] GetExitCodeProcess (in: hProcess=0x6a0, lpExitCode=0x265ce88 | out: lpExitCode=0x265ce88*=0x103) returned 1 [0058.828] GetLastError () returned 0x0 [0058.828] CheckRemoteDebuggerPresent (in: hProcess=0x6a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.828] GetLastError () returned 0x0 [0058.828] GetCurrentProcessId () returned 0x13cc [0058.828] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6a4 [0058.828] GetLastError () returned 0x0 [0058.828] GetExitCodeProcess (in: hProcess=0x6a4, lpExitCode=0x265cf3c | out: lpExitCode=0x265cf3c*=0x103) returned 1 [0058.828] GetLastError () returned 0x0 [0058.828] CheckRemoteDebuggerPresent (in: hProcess=0x6a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.828] GetLastError () returned 0x0 [0058.828] GetCurrentProcessId () returned 0x13cc [0058.828] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6a8 [0058.828] GetLastError () returned 0x0 [0058.828] GetExitCodeProcess (in: hProcess=0x6a8, lpExitCode=0x265cff0 | out: lpExitCode=0x265cff0*=0x103) returned 1 [0058.829] GetLastError () returned 0x0 [0058.829] CheckRemoteDebuggerPresent (in: hProcess=0x6a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.829] GetLastError () returned 0x0 [0058.829] GetCurrentProcessId () returned 0x13cc [0058.829] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6ac [0058.829] GetLastError () returned 0x0 [0058.829] GetExitCodeProcess (in: hProcess=0x6ac, lpExitCode=0x265d0a4 | out: lpExitCode=0x265d0a4*=0x103) returned 1 [0058.829] GetLastError () returned 0x0 [0058.829] CheckRemoteDebuggerPresent (in: hProcess=0x6ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.829] GetLastError () returned 0x0 [0058.829] GetCurrentProcessId () returned 0x13cc [0058.829] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6b0 [0058.829] GetLastError () returned 0x0 [0058.829] GetExitCodeProcess (in: hProcess=0x6b0, lpExitCode=0x265d158 | out: lpExitCode=0x265d158*=0x103) returned 1 [0058.829] GetLastError () returned 0x0 [0058.829] CheckRemoteDebuggerPresent (in: hProcess=0x6b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.829] GetLastError () returned 0x0 [0058.829] GetCurrentProcessId () returned 0x13cc [0058.830] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6b4 [0058.830] GetLastError () returned 0x0 [0058.830] GetExitCodeProcess (in: hProcess=0x6b4, lpExitCode=0x265d20c | out: lpExitCode=0x265d20c*=0x103) returned 1 [0058.830] GetLastError () returned 0x0 [0058.830] CheckRemoteDebuggerPresent (in: hProcess=0x6b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.830] GetLastError () returned 0x0 [0058.830] GetCurrentProcessId () returned 0x13cc [0058.830] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6b8 [0058.830] GetLastError () returned 0x0 [0058.830] GetExitCodeProcess (in: hProcess=0x6b8, lpExitCode=0x265d2c0 | out: lpExitCode=0x265d2c0*=0x103) returned 1 [0058.830] GetLastError () returned 0x0 [0058.830] CheckRemoteDebuggerPresent (in: hProcess=0x6b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.830] GetLastError () returned 0x0 [0058.830] GetCurrentProcessId () returned 0x13cc [0058.830] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6bc [0058.830] GetLastError () returned 0x0 [0058.830] GetExitCodeProcess (in: hProcess=0x6bc, lpExitCode=0x265d374 | out: lpExitCode=0x265d374*=0x103) returned 1 [0058.830] GetLastError () returned 0x0 [0058.831] CheckRemoteDebuggerPresent (in: hProcess=0x6bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.831] GetLastError () returned 0x0 [0058.831] GetCurrentProcessId () returned 0x13cc [0058.831] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6c0 [0058.831] GetLastError () returned 0x0 [0058.831] GetExitCodeProcess (in: hProcess=0x6c0, lpExitCode=0x265d428 | out: lpExitCode=0x265d428*=0x103) returned 1 [0058.831] GetLastError () returned 0x0 [0058.831] CheckRemoteDebuggerPresent (in: hProcess=0x6c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.831] GetLastError () returned 0x0 [0058.831] GetCurrentProcessId () returned 0x13cc [0058.831] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6c4 [0058.831] GetLastError () returned 0x0 [0058.831] GetExitCodeProcess (in: hProcess=0x6c4, lpExitCode=0x265d4dc | out: lpExitCode=0x265d4dc*=0x103) returned 1 [0058.831] GetLastError () returned 0x0 [0058.831] CheckRemoteDebuggerPresent (in: hProcess=0x6c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.831] GetLastError () returned 0x0 [0058.831] GetCurrentProcessId () returned 0x13cc [0058.831] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6c8 [0058.831] GetLastError () returned 0x0 [0058.832] GetExitCodeProcess (in: hProcess=0x6c8, lpExitCode=0x265d590 | out: lpExitCode=0x265d590*=0x103) returned 1 [0058.832] GetLastError () returned 0x0 [0058.832] CheckRemoteDebuggerPresent (in: hProcess=0x6c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.832] GetLastError () returned 0x0 [0058.832] GetCurrentProcessId () returned 0x13cc [0058.832] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6cc [0058.832] GetLastError () returned 0x0 [0058.832] GetExitCodeProcess (in: hProcess=0x6cc, lpExitCode=0x265d644 | out: lpExitCode=0x265d644*=0x103) returned 1 [0058.832] GetLastError () returned 0x0 [0058.832] CheckRemoteDebuggerPresent (in: hProcess=0x6cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.832] GetLastError () returned 0x0 [0058.832] GetCurrentProcessId () returned 0x13cc [0058.832] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6d0 [0058.832] GetLastError () returned 0x0 [0058.832] GetExitCodeProcess (in: hProcess=0x6d0, lpExitCode=0x265d6f8 | out: lpExitCode=0x265d6f8*=0x103) returned 1 [0058.832] GetLastError () returned 0x0 [0058.832] CheckRemoteDebuggerPresent (in: hProcess=0x6d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.832] GetLastError () returned 0x0 [0058.832] GetCurrentProcessId () returned 0x13cc [0058.833] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6d4 [0058.833] GetLastError () returned 0x0 [0058.833] GetExitCodeProcess (in: hProcess=0x6d4, lpExitCode=0x265d7ac | out: lpExitCode=0x265d7ac*=0x103) returned 1 [0058.833] GetLastError () returned 0x0 [0058.833] CheckRemoteDebuggerPresent (in: hProcess=0x6d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.833] GetLastError () returned 0x0 [0058.833] GetCurrentProcessId () returned 0x13cc [0058.833] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6d8 [0058.833] GetLastError () returned 0x0 [0058.833] GetExitCodeProcess (in: hProcess=0x6d8, lpExitCode=0x265d860 | out: lpExitCode=0x265d860*=0x103) returned 1 [0058.833] GetLastError () returned 0x0 [0058.833] CheckRemoteDebuggerPresent (in: hProcess=0x6d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.833] GetLastError () returned 0x0 [0058.833] GetCurrentProcessId () returned 0x13cc [0058.833] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6dc [0058.833] GetLastError () returned 0x0 [0058.833] GetExitCodeProcess (in: hProcess=0x6dc, lpExitCode=0x265d914 | out: lpExitCode=0x265d914*=0x103) returned 1 [0058.833] GetLastError () returned 0x0 [0058.833] CheckRemoteDebuggerPresent (in: hProcess=0x6dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.834] GetLastError () returned 0x0 [0058.834] GetCurrentProcessId () returned 0x13cc [0058.834] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6e0 [0058.834] GetLastError () returned 0x0 [0058.834] GetExitCodeProcess (in: hProcess=0x6e0, lpExitCode=0x265d9c8 | out: lpExitCode=0x265d9c8*=0x103) returned 1 [0058.834] GetLastError () returned 0x0 [0058.834] CheckRemoteDebuggerPresent (in: hProcess=0x6e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.834] GetLastError () returned 0x0 [0058.834] GetCurrentProcessId () returned 0x13cc [0058.834] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6e4 [0058.834] GetLastError () returned 0x0 [0058.834] GetExitCodeProcess (in: hProcess=0x6e4, lpExitCode=0x265da7c | out: lpExitCode=0x265da7c*=0x103) returned 1 [0058.834] GetLastError () returned 0x0 [0058.834] CheckRemoteDebuggerPresent (in: hProcess=0x6e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.834] GetLastError () returned 0x0 [0058.834] GetCurrentProcessId () returned 0x13cc [0058.834] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6e8 [0058.834] GetLastError () returned 0x0 [0058.835] GetExitCodeProcess (in: hProcess=0x6e8, lpExitCode=0x265db30 | out: lpExitCode=0x265db30*=0x103) returned 1 [0058.835] GetLastError () returned 0x0 [0058.835] CheckRemoteDebuggerPresent (in: hProcess=0x6e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.835] GetLastError () returned 0x0 [0058.835] GetCurrentProcessId () returned 0x13cc [0058.835] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6ec [0058.835] GetLastError () returned 0x0 [0058.835] GetExitCodeProcess (in: hProcess=0x6ec, lpExitCode=0x265dbe4 | out: lpExitCode=0x265dbe4*=0x103) returned 1 [0058.835] GetLastError () returned 0x0 [0058.835] CheckRemoteDebuggerPresent (in: hProcess=0x6ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.835] GetLastError () returned 0x0 [0058.835] GetCurrentProcessId () returned 0x13cc [0058.835] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6f0 [0058.835] GetLastError () returned 0x0 [0058.835] GetExitCodeProcess (in: hProcess=0x6f0, lpExitCode=0x265dc98 | out: lpExitCode=0x265dc98*=0x103) returned 1 [0058.835] GetLastError () returned 0x0 [0058.835] CheckRemoteDebuggerPresent (in: hProcess=0x6f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.835] GetLastError () returned 0x0 [0058.835] GetCurrentProcessId () returned 0x13cc [0058.836] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6f4 [0058.836] GetLastError () returned 0x0 [0058.836] GetExitCodeProcess (in: hProcess=0x6f4, lpExitCode=0x265dd4c | out: lpExitCode=0x265dd4c*=0x103) returned 1 [0058.836] GetLastError () returned 0x0 [0058.836] CheckRemoteDebuggerPresent (in: hProcess=0x6f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.836] GetLastError () returned 0x0 [0058.836] GetCurrentProcessId () returned 0x13cc [0058.836] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6f8 [0058.836] GetLastError () returned 0x0 [0058.836] GetExitCodeProcess (in: hProcess=0x6f8, lpExitCode=0x265de00 | out: lpExitCode=0x265de00*=0x103) returned 1 [0058.836] GetLastError () returned 0x0 [0058.836] CheckRemoteDebuggerPresent (in: hProcess=0x6f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.836] GetLastError () returned 0x0 [0058.836] GetCurrentProcessId () returned 0x13cc [0058.836] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x6fc [0058.836] GetLastError () returned 0x0 [0058.836] GetExitCodeProcess (in: hProcess=0x6fc, lpExitCode=0x265deb4 | out: lpExitCode=0x265deb4*=0x103) returned 1 [0058.836] GetLastError () returned 0x0 [0058.836] CheckRemoteDebuggerPresent (in: hProcess=0x6fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.836] GetLastError () returned 0x0 [0058.837] GetCurrentProcessId () returned 0x13cc [0058.837] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x700 [0058.837] GetLastError () returned 0x0 [0058.837] GetExitCodeProcess (in: hProcess=0x700, lpExitCode=0x265df68 | out: lpExitCode=0x265df68*=0x103) returned 1 [0058.837] GetLastError () returned 0x0 [0058.837] CheckRemoteDebuggerPresent (in: hProcess=0x700, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.837] GetLastError () returned 0x0 [0058.837] GetCurrentProcessId () returned 0x13cc [0058.837] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x704 [0058.837] GetLastError () returned 0x0 [0058.837] GetExitCodeProcess (in: hProcess=0x704, lpExitCode=0x265e01c | out: lpExitCode=0x265e01c*=0x103) returned 1 [0058.837] GetLastError () returned 0x0 [0058.837] CheckRemoteDebuggerPresent (in: hProcess=0x704, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.837] GetLastError () returned 0x0 [0058.837] GetCurrentProcessId () returned 0x13cc [0058.837] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x708 [0058.838] GetLastError () returned 0x0 [0058.838] GetExitCodeProcess (in: hProcess=0x708, lpExitCode=0x265e0d0 | out: lpExitCode=0x265e0d0*=0x103) returned 1 [0058.838] GetLastError () returned 0x0 [0058.838] CheckRemoteDebuggerPresent (in: hProcess=0x708, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.838] GetLastError () returned 0x0 [0058.838] GetCurrentProcessId () returned 0x13cc [0058.838] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x70c [0058.838] GetLastError () returned 0x0 [0058.838] GetExitCodeProcess (in: hProcess=0x70c, lpExitCode=0x265e184 | out: lpExitCode=0x265e184*=0x103) returned 1 [0058.838] GetLastError () returned 0x0 [0058.838] CheckRemoteDebuggerPresent (in: hProcess=0x70c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.838] GetLastError () returned 0x0 [0058.838] GetCurrentProcessId () returned 0x13cc [0058.838] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x710 [0058.838] GetLastError () returned 0x0 [0058.838] GetExitCodeProcess (in: hProcess=0x710, lpExitCode=0x265e238 | out: lpExitCode=0x265e238*=0x103) returned 1 [0058.838] GetLastError () returned 0x0 [0058.838] CheckRemoteDebuggerPresent (in: hProcess=0x710, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.839] GetLastError () returned 0x0 [0058.839] GetCurrentProcessId () returned 0x13cc [0058.839] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x714 [0058.839] GetLastError () returned 0x0 [0058.839] GetExitCodeProcess (in: hProcess=0x714, lpExitCode=0x265e2ec | out: lpExitCode=0x265e2ec*=0x103) returned 1 [0058.839] GetLastError () returned 0x0 [0058.839] CheckRemoteDebuggerPresent (in: hProcess=0x714, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.839] GetLastError () returned 0x0 [0058.839] GetCurrentProcessId () returned 0x13cc [0058.839] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x718 [0058.839] GetLastError () returned 0x0 [0058.839] GetExitCodeProcess (in: hProcess=0x718, lpExitCode=0x265e3a0 | out: lpExitCode=0x265e3a0*=0x103) returned 1 [0058.839] GetLastError () returned 0x0 [0058.839] CheckRemoteDebuggerPresent (in: hProcess=0x718, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.839] GetLastError () returned 0x0 [0058.839] GetCurrentProcessId () returned 0x13cc [0058.839] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x71c [0058.839] GetLastError () returned 0x0 [0058.840] GetExitCodeProcess (in: hProcess=0x71c, lpExitCode=0x265e454 | out: lpExitCode=0x265e454*=0x103) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] CheckRemoteDebuggerPresent (in: hProcess=0x71c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] GetCurrentProcessId () returned 0x13cc [0058.840] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x720 [0058.840] GetLastError () returned 0x0 [0058.840] GetExitCodeProcess (in: hProcess=0x720, lpExitCode=0x265e508 | out: lpExitCode=0x265e508*=0x103) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] CheckRemoteDebuggerPresent (in: hProcess=0x720, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] GetCurrentProcessId () returned 0x13cc [0058.840] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x724 [0058.840] GetLastError () returned 0x0 [0058.840] GetExitCodeProcess (in: hProcess=0x724, lpExitCode=0x265e5bc | out: lpExitCode=0x265e5bc*=0x103) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] CheckRemoteDebuggerPresent (in: hProcess=0x724, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] GetCurrentProcessId () returned 0x13cc [0058.841] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x728 [0058.841] GetLastError () returned 0x0 [0058.841] GetExitCodeProcess (in: hProcess=0x728, lpExitCode=0x265e670 | out: lpExitCode=0x265e670*=0x103) returned 1 [0058.841] GetLastError () returned 0x0 [0058.841] CheckRemoteDebuggerPresent (in: hProcess=0x728, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.841] GetLastError () returned 0x0 [0058.841] GetCurrentProcessId () returned 0x13cc [0058.841] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x72c [0058.841] GetLastError () returned 0x0 [0058.841] GetExitCodeProcess (in: hProcess=0x72c, lpExitCode=0x265e724 | out: lpExitCode=0x265e724*=0x103) returned 1 [0058.841] GetLastError () returned 0x0 [0058.841] CheckRemoteDebuggerPresent (in: hProcess=0x72c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.841] GetLastError () returned 0x0 [0058.841] GetCurrentProcessId () returned 0x13cc [0058.841] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x730 [0058.841] GetLastError () returned 0x0 [0058.841] GetExitCodeProcess (in: hProcess=0x730, lpExitCode=0x265e7d8 | out: lpExitCode=0x265e7d8*=0x103) returned 1 [0058.841] GetLastError () returned 0x0 [0058.841] CheckRemoteDebuggerPresent (in: hProcess=0x730, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.841] GetLastError () returned 0x0 [0058.842] GetCurrentProcessId () returned 0x13cc [0058.842] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x734 [0058.842] GetLastError () returned 0x0 [0058.842] GetExitCodeProcess (in: hProcess=0x734, lpExitCode=0x265e88c | out: lpExitCode=0x265e88c*=0x103) returned 1 [0058.842] GetLastError () returned 0x0 [0058.842] CheckRemoteDebuggerPresent (in: hProcess=0x734, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.842] GetLastError () returned 0x0 [0058.842] GetCurrentProcessId () returned 0x13cc [0058.842] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x738 [0058.842] GetLastError () returned 0x0 [0058.842] GetExitCodeProcess (in: hProcess=0x738, lpExitCode=0x265e940 | out: lpExitCode=0x265e940*=0x103) returned 1 [0058.842] GetLastError () returned 0x0 [0058.842] CheckRemoteDebuggerPresent (in: hProcess=0x738, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.842] GetLastError () returned 0x0 [0058.842] GetCurrentProcessId () returned 0x13cc [0058.842] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x73c [0058.842] GetLastError () returned 0x0 [0058.842] GetExitCodeProcess (in: hProcess=0x73c, lpExitCode=0x265e9f4 | out: lpExitCode=0x265e9f4*=0x103) returned 1 [0058.842] GetLastError () returned 0x0 [0058.843] CheckRemoteDebuggerPresent (in: hProcess=0x73c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.843] GetLastError () returned 0x0 [0058.843] GetCurrentProcessId () returned 0x13cc [0058.843] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x740 [0058.843] GetLastError () returned 0x0 [0058.843] GetExitCodeProcess (in: hProcess=0x740, lpExitCode=0x265eaa8 | out: lpExitCode=0x265eaa8*=0x103) returned 1 [0058.843] GetLastError () returned 0x0 [0058.843] CheckRemoteDebuggerPresent (in: hProcess=0x740, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.843] GetLastError () returned 0x0 [0058.843] GetCurrentProcessId () returned 0x13cc [0058.843] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x744 [0058.843] GetLastError () returned 0x0 [0058.843] GetExitCodeProcess (in: hProcess=0x744, lpExitCode=0x265eb5c | out: lpExitCode=0x265eb5c*=0x103) returned 1 [0058.843] GetLastError () returned 0x0 [0058.843] CheckRemoteDebuggerPresent (in: hProcess=0x744, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.843] GetLastError () returned 0x0 [0058.843] GetCurrentProcessId () returned 0x13cc [0058.844] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x748 [0058.844] GetLastError () returned 0x0 [0058.844] GetExitCodeProcess (in: hProcess=0x748, lpExitCode=0x265ec10 | out: lpExitCode=0x265ec10*=0x103) returned 1 [0058.844] GetLastError () returned 0x0 [0058.844] CheckRemoteDebuggerPresent (in: hProcess=0x748, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.844] GetLastError () returned 0x0 [0058.844] GetCurrentProcessId () returned 0x13cc [0058.844] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x74c [0058.844] GetLastError () returned 0x0 [0058.844] GetExitCodeProcess (in: hProcess=0x74c, lpExitCode=0x265ecc4 | out: lpExitCode=0x265ecc4*=0x103) returned 1 [0058.844] GetLastError () returned 0x0 [0058.844] CheckRemoteDebuggerPresent (in: hProcess=0x74c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.844] GetLastError () returned 0x0 [0058.844] GetCurrentProcessId () returned 0x13cc [0058.844] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x750 [0058.844] GetLastError () returned 0x0 [0058.844] GetExitCodeProcess (in: hProcess=0x750, lpExitCode=0x265ed78 | out: lpExitCode=0x265ed78*=0x103) returned 1 [0058.844] GetLastError () returned 0x0 [0058.844] CheckRemoteDebuggerPresent (in: hProcess=0x750, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.844] GetLastError () returned 0x0 [0058.845] GetCurrentProcessId () returned 0x13cc [0058.845] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x754 [0058.845] GetLastError () returned 0x0 [0058.845] GetExitCodeProcess (in: hProcess=0x754, lpExitCode=0x265ee2c | out: lpExitCode=0x265ee2c*=0x103) returned 1 [0058.845] GetLastError () returned 0x0 [0058.845] CheckRemoteDebuggerPresent (in: hProcess=0x754, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.845] GetLastError () returned 0x0 [0058.845] GetCurrentProcessId () returned 0x13cc [0058.845] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x758 [0058.845] GetLastError () returned 0x0 [0058.845] GetExitCodeProcess (in: hProcess=0x758, lpExitCode=0x265eee0 | out: lpExitCode=0x265eee0*=0x103) returned 1 [0058.845] GetLastError () returned 0x0 [0058.845] CheckRemoteDebuggerPresent (in: hProcess=0x758, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.845] GetLastError () returned 0x0 [0058.845] GetCurrentProcessId () returned 0x13cc [0058.845] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x75c [0058.845] GetLastError () returned 0x0 [0058.845] GetExitCodeProcess (in: hProcess=0x75c, lpExitCode=0x265ef94 | out: lpExitCode=0x265ef94*=0x103) returned 1 [0058.845] GetLastError () returned 0x0 [0058.846] CheckRemoteDebuggerPresent (in: hProcess=0x75c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.846] GetLastError () returned 0x0 [0058.846] GetCurrentProcessId () returned 0x13cc [0058.846] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x760 [0058.846] GetLastError () returned 0x0 [0058.846] GetExitCodeProcess (in: hProcess=0x760, lpExitCode=0x265f048 | out: lpExitCode=0x265f048*=0x103) returned 1 [0058.846] GetLastError () returned 0x0 [0058.846] CheckRemoteDebuggerPresent (in: hProcess=0x760, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.846] GetLastError () returned 0x0 [0058.846] GetCurrentProcessId () returned 0x13cc [0058.846] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x764 [0058.846] GetLastError () returned 0x0 [0058.846] GetExitCodeProcess (in: hProcess=0x764, lpExitCode=0x265f0fc | out: lpExitCode=0x265f0fc*=0x103) returned 1 [0058.846] GetLastError () returned 0x0 [0058.846] CheckRemoteDebuggerPresent (in: hProcess=0x764, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.846] GetLastError () returned 0x0 [0058.846] GetCurrentProcessId () returned 0x13cc [0058.846] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x768 [0058.846] GetLastError () returned 0x0 [0058.847] GetExitCodeProcess (in: hProcess=0x768, lpExitCode=0x265f1b0 | out: lpExitCode=0x265f1b0*=0x103) returned 1 [0058.847] GetLastError () returned 0x0 [0058.847] CheckRemoteDebuggerPresent (in: hProcess=0x768, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.847] GetLastError () returned 0x0 [0058.847] GetCurrentProcessId () returned 0x13cc [0058.847] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x76c [0058.847] GetLastError () returned 0x0 [0058.847] GetExitCodeProcess (in: hProcess=0x76c, lpExitCode=0x265f264 | out: lpExitCode=0x265f264*=0x103) returned 1 [0058.847] GetLastError () returned 0x0 [0058.847] CheckRemoteDebuggerPresent (in: hProcess=0x76c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.847] GetLastError () returned 0x0 [0058.847] GetCurrentProcessId () returned 0x13cc [0058.847] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x770 [0058.847] GetLastError () returned 0x0 [0058.847] GetExitCodeProcess (in: hProcess=0x770, lpExitCode=0x265f318 | out: lpExitCode=0x265f318*=0x103) returned 1 [0058.847] GetLastError () returned 0x0 [0058.847] CheckRemoteDebuggerPresent (in: hProcess=0x770, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.847] GetLastError () returned 0x0 [0058.847] GetCurrentProcessId () returned 0x13cc [0058.848] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x774 [0058.848] GetLastError () returned 0x0 [0058.848] GetExitCodeProcess (in: hProcess=0x774, lpExitCode=0x265f3cc | out: lpExitCode=0x265f3cc*=0x103) returned 1 [0058.848] GetLastError () returned 0x0 [0058.848] CheckRemoteDebuggerPresent (in: hProcess=0x774, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.848] GetLastError () returned 0x0 [0058.848] GetCurrentProcessId () returned 0x13cc [0058.848] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x778 [0058.848] GetLastError () returned 0x0 [0058.848] GetExitCodeProcess (in: hProcess=0x778, lpExitCode=0x265f480 | out: lpExitCode=0x265f480*=0x103) returned 1 [0058.848] GetLastError () returned 0x0 [0058.848] CheckRemoteDebuggerPresent (in: hProcess=0x778, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.848] GetLastError () returned 0x0 [0058.848] GetCurrentProcessId () returned 0x13cc [0058.848] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x77c [0058.848] GetLastError () returned 0x0 [0058.848] GetExitCodeProcess (in: hProcess=0x77c, lpExitCode=0x265f534 | out: lpExitCode=0x265f534*=0x103) returned 1 [0058.848] GetLastError () returned 0x0 [0058.848] CheckRemoteDebuggerPresent (in: hProcess=0x77c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.849] GetLastError () returned 0x0 [0058.849] GetCurrentProcessId () returned 0x13cc [0058.849] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x780 [0058.849] GetLastError () returned 0x0 [0058.849] GetExitCodeProcess (in: hProcess=0x780, lpExitCode=0x265f5e8 | out: lpExitCode=0x265f5e8*=0x103) returned 1 [0058.849] GetLastError () returned 0x0 [0058.849] CheckRemoteDebuggerPresent (in: hProcess=0x780, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.849] GetLastError () returned 0x0 [0058.849] GetCurrentProcessId () returned 0x13cc [0058.849] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x784 [0058.849] GetLastError () returned 0x0 [0058.849] GetExitCodeProcess (in: hProcess=0x784, lpExitCode=0x265f69c | out: lpExitCode=0x265f69c*=0x103) returned 1 [0058.849] GetLastError () returned 0x0 [0058.849] CheckRemoteDebuggerPresent (in: hProcess=0x784, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.849] GetLastError () returned 0x0 [0058.849] GetCurrentProcessId () returned 0x13cc [0058.849] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x788 [0058.849] GetLastError () returned 0x0 [0058.850] GetExitCodeProcess (in: hProcess=0x788, lpExitCode=0x265f750 | out: lpExitCode=0x265f750*=0x103) returned 1 [0058.850] GetLastError () returned 0x0 [0058.850] CheckRemoteDebuggerPresent (in: hProcess=0x788, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.850] GetLastError () returned 0x0 [0058.850] GetCurrentProcessId () returned 0x13cc [0058.850] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x78c [0058.850] GetLastError () returned 0x0 [0058.850] GetExitCodeProcess (in: hProcess=0x78c, lpExitCode=0x265f804 | out: lpExitCode=0x265f804*=0x103) returned 1 [0058.850] GetLastError () returned 0x0 [0058.850] CheckRemoteDebuggerPresent (in: hProcess=0x78c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.850] GetLastError () returned 0x0 [0058.850] GetCurrentProcessId () returned 0x13cc [0058.850] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x790 [0058.850] GetLastError () returned 0x0 [0058.850] GetExitCodeProcess (in: hProcess=0x790, lpExitCode=0x265f8b8 | out: lpExitCode=0x265f8b8*=0x103) returned 1 [0058.850] GetLastError () returned 0x0 [0058.850] CheckRemoteDebuggerPresent (in: hProcess=0x790, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.850] GetLastError () returned 0x0 [0058.850] GetCurrentProcessId () returned 0x13cc [0058.851] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x794 [0058.851] GetLastError () returned 0x0 [0058.851] GetExitCodeProcess (in: hProcess=0x794, lpExitCode=0x265f96c | out: lpExitCode=0x265f96c*=0x103) returned 1 [0058.851] GetLastError () returned 0x0 [0058.851] CheckRemoteDebuggerPresent (in: hProcess=0x794, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.851] GetLastError () returned 0x0 [0058.851] GetCurrentProcessId () returned 0x13cc [0058.851] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x798 [0058.851] GetLastError () returned 0x0 [0058.851] GetExitCodeProcess (in: hProcess=0x798, lpExitCode=0x265fa20 | out: lpExitCode=0x265fa20*=0x103) returned 1 [0058.851] GetLastError () returned 0x0 [0058.851] CheckRemoteDebuggerPresent (in: hProcess=0x798, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.851] GetLastError () returned 0x0 [0058.851] GetCurrentProcessId () returned 0x13cc [0058.851] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x79c [0058.851] GetLastError () returned 0x0 [0058.851] GetExitCodeProcess (in: hProcess=0x79c, lpExitCode=0x265fad4 | out: lpExitCode=0x265fad4*=0x103) returned 1 [0058.851] GetLastError () returned 0x0 [0058.851] CheckRemoteDebuggerPresent (in: hProcess=0x79c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.852] GetLastError () returned 0x0 [0058.852] GetCurrentProcessId () returned 0x13cc [0058.852] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7a0 [0058.852] GetLastError () returned 0x0 [0058.852] GetExitCodeProcess (in: hProcess=0x7a0, lpExitCode=0x265fb88 | out: lpExitCode=0x265fb88*=0x103) returned 1 [0058.852] GetLastError () returned 0x0 [0058.852] CheckRemoteDebuggerPresent (in: hProcess=0x7a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.852] GetLastError () returned 0x0 [0058.852] GetCurrentProcessId () returned 0x13cc [0058.852] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7a4 [0058.852] GetLastError () returned 0x0 [0058.852] GetExitCodeProcess (in: hProcess=0x7a4, lpExitCode=0x265fc3c | out: lpExitCode=0x265fc3c*=0x103) returned 1 [0058.852] GetLastError () returned 0x0 [0058.852] CheckRemoteDebuggerPresent (in: hProcess=0x7a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.852] GetLastError () returned 0x0 [0058.852] GetCurrentProcessId () returned 0x13cc [0058.852] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7a8 [0058.853] GetLastError () returned 0x0 [0058.853] GetExitCodeProcess (in: hProcess=0x7a8, lpExitCode=0x265fcf0 | out: lpExitCode=0x265fcf0*=0x103) returned 1 [0058.853] GetLastError () returned 0x0 [0058.853] CheckRemoteDebuggerPresent (in: hProcess=0x7a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.853] GetLastError () returned 0x0 [0058.853] GetCurrentProcessId () returned 0x13cc [0058.853] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7ac [0058.853] GetLastError () returned 0x0 [0058.853] GetExitCodeProcess (in: hProcess=0x7ac, lpExitCode=0x265fda4 | out: lpExitCode=0x265fda4*=0x103) returned 1 [0058.853] GetLastError () returned 0x0 [0058.853] CheckRemoteDebuggerPresent (in: hProcess=0x7ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.853] GetLastError () returned 0x0 [0058.853] GetCurrentProcessId () returned 0x13cc [0058.853] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7b0 [0058.853] GetLastError () returned 0x0 [0058.853] GetExitCodeProcess (in: hProcess=0x7b0, lpExitCode=0x265fe58 | out: lpExitCode=0x265fe58*=0x103) returned 1 [0058.853] GetLastError () returned 0x0 [0058.853] CheckRemoteDebuggerPresent (in: hProcess=0x7b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.854] GetLastError () returned 0x0 [0058.854] GetCurrentProcessId () returned 0x13cc [0058.854] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7b4 [0058.854] GetLastError () returned 0x0 [0058.854] GetExitCodeProcess (in: hProcess=0x7b4, lpExitCode=0x265ff0c | out: lpExitCode=0x265ff0c*=0x103) returned 1 [0058.854] GetLastError () returned 0x0 [0058.854] CheckRemoteDebuggerPresent (in: hProcess=0x7b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.854] GetLastError () returned 0x0 [0058.854] GetCurrentProcessId () returned 0x13cc [0058.854] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7b8 [0058.854] GetLastError () returned 0x0 [0058.854] GetExitCodeProcess (in: hProcess=0x7b8, lpExitCode=0x265ffc0 | out: lpExitCode=0x265ffc0*=0x103) returned 1 [0058.854] GetLastError () returned 0x0 [0058.854] CheckRemoteDebuggerPresent (in: hProcess=0x7b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.855] GetLastError () returned 0x0 [0058.855] GetCurrentProcessId () returned 0x13cc [0058.855] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7bc [0058.855] GetLastError () returned 0x0 [0058.855] GetExitCodeProcess (in: hProcess=0x7bc, lpExitCode=0x2660074 | out: lpExitCode=0x2660074*=0x103) returned 1 [0058.855] GetLastError () returned 0x0 [0058.855] CheckRemoteDebuggerPresent (in: hProcess=0x7bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.855] GetLastError () returned 0x0 [0058.855] GetCurrentProcessId () returned 0x13cc [0058.855] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7c0 [0058.855] GetLastError () returned 0x0 [0058.856] GetExitCodeProcess (in: hProcess=0x7c0, lpExitCode=0x2660128 | out: lpExitCode=0x2660128*=0x103) returned 1 [0058.856] GetLastError () returned 0x0 [0058.856] CheckRemoteDebuggerPresent (in: hProcess=0x7c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.856] GetLastError () returned 0x0 [0058.856] GetCurrentProcessId () returned 0x13cc [0058.856] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7c4 [0058.856] GetLastError () returned 0x0 [0058.856] GetExitCodeProcess (in: hProcess=0x7c4, lpExitCode=0x26601dc | out: lpExitCode=0x26601dc*=0x103) returned 1 [0058.856] GetLastError () returned 0x0 [0058.856] CheckRemoteDebuggerPresent (in: hProcess=0x7c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.856] GetLastError () returned 0x0 [0058.856] GetCurrentProcessId () returned 0x13cc [0058.856] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7c8 [0058.856] GetLastError () returned 0x0 [0058.856] GetExitCodeProcess (in: hProcess=0x7c8, lpExitCode=0x2660290 | out: lpExitCode=0x2660290*=0x103) returned 1 [0058.856] GetLastError () returned 0x0 [0058.856] CheckRemoteDebuggerPresent (in: hProcess=0x7c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.856] GetLastError () returned 0x0 [0058.857] GetCurrentProcessId () returned 0x13cc [0058.857] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7cc [0058.857] GetLastError () returned 0x0 [0058.857] GetExitCodeProcess (in: hProcess=0x7cc, lpExitCode=0x2660344 | out: lpExitCode=0x2660344*=0x103) returned 1 [0058.857] GetLastError () returned 0x0 [0058.857] CheckRemoteDebuggerPresent (in: hProcess=0x7cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.857] GetLastError () returned 0x0 [0058.857] GetCurrentProcessId () returned 0x13cc [0058.857] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7d0 [0058.857] GetLastError () returned 0x0 [0058.857] GetExitCodeProcess (in: hProcess=0x7d0, lpExitCode=0x26603f8 | out: lpExitCode=0x26603f8*=0x103) returned 1 [0058.857] GetLastError () returned 0x0 [0058.857] CheckRemoteDebuggerPresent (in: hProcess=0x7d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.857] GetLastError () returned 0x0 [0058.857] GetCurrentProcessId () returned 0x13cc [0058.857] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7d4 [0058.857] GetLastError () returned 0x0 [0058.857] GetExitCodeProcess (in: hProcess=0x7d4, lpExitCode=0x26604ac | out: lpExitCode=0x26604ac*=0x103) returned 1 [0058.857] GetLastError () returned 0x0 [0058.858] CheckRemoteDebuggerPresent (in: hProcess=0x7d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.858] GetLastError () returned 0x0 [0058.858] GetCurrentProcessId () returned 0x13cc [0058.858] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7d8 [0058.858] GetLastError () returned 0x0 [0058.858] GetExitCodeProcess (in: hProcess=0x7d8, lpExitCode=0x2660560 | out: lpExitCode=0x2660560*=0x103) returned 1 [0058.858] GetLastError () returned 0x0 [0058.858] CheckRemoteDebuggerPresent (in: hProcess=0x7d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.858] GetLastError () returned 0x0 [0058.858] GetCurrentProcessId () returned 0x13cc [0058.858] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7dc [0058.858] GetLastError () returned 0x0 [0058.858] GetExitCodeProcess (in: hProcess=0x7dc, lpExitCode=0x2660614 | out: lpExitCode=0x2660614*=0x103) returned 1 [0058.858] GetLastError () returned 0x0 [0058.858] CheckRemoteDebuggerPresent (in: hProcess=0x7dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.858] GetLastError () returned 0x0 [0058.858] GetCurrentProcessId () returned 0x13cc [0058.859] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7e0 [0058.859] GetLastError () returned 0x0 [0058.859] GetExitCodeProcess (in: hProcess=0x7e0, lpExitCode=0x26606c8 | out: lpExitCode=0x26606c8*=0x103) returned 1 [0058.859] GetLastError () returned 0x0 [0058.859] CheckRemoteDebuggerPresent (in: hProcess=0x7e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.859] GetLastError () returned 0x0 [0058.859] GetCurrentProcessId () returned 0x13cc [0058.859] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7e4 [0058.859] GetLastError () returned 0x0 [0058.859] GetExitCodeProcess (in: hProcess=0x7e4, lpExitCode=0x266077c | out: lpExitCode=0x266077c*=0x103) returned 1 [0058.859] GetLastError () returned 0x0 [0058.859] CheckRemoteDebuggerPresent (in: hProcess=0x7e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.859] GetLastError () returned 0x0 [0058.859] GetCurrentProcessId () returned 0x13cc [0058.859] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7e8 [0058.859] GetLastError () returned 0x0 [0058.859] GetExitCodeProcess (in: hProcess=0x7e8, lpExitCode=0x2660830 | out: lpExitCode=0x2660830*=0x103) returned 1 [0058.859] GetLastError () returned 0x0 [0058.859] CheckRemoteDebuggerPresent (in: hProcess=0x7e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.860] GetLastError () returned 0x0 [0058.860] GetCurrentProcessId () returned 0x13cc [0058.860] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7ec [0058.860] GetLastError () returned 0x0 [0058.860] GetExitCodeProcess (in: hProcess=0x7ec, lpExitCode=0x26608e4 | out: lpExitCode=0x26608e4*=0x103) returned 1 [0058.860] GetLastError () returned 0x0 [0058.860] CheckRemoteDebuggerPresent (in: hProcess=0x7ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.860] GetLastError () returned 0x0 [0058.860] GetCurrentProcessId () returned 0x13cc [0058.860] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7f0 [0058.860] GetLastError () returned 0x0 [0058.860] GetExitCodeProcess (in: hProcess=0x7f0, lpExitCode=0x2660998 | out: lpExitCode=0x2660998*=0x103) returned 1 [0058.860] GetLastError () returned 0x0 [0058.860] CheckRemoteDebuggerPresent (in: hProcess=0x7f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.860] GetLastError () returned 0x0 [0058.860] GetCurrentProcessId () returned 0x13cc [0058.860] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7f4 [0058.860] GetLastError () returned 0x0 [0058.860] GetExitCodeProcess (in: hProcess=0x7f4, lpExitCode=0x2660a4c | out: lpExitCode=0x2660a4c*=0x103) returned 1 [0058.860] GetLastError () returned 0x0 [0058.861] CheckRemoteDebuggerPresent (in: hProcess=0x7f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.861] GetLastError () returned 0x0 [0058.861] GetCurrentProcessId () returned 0x13cc [0058.861] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7f8 [0058.861] GetLastError () returned 0x0 [0058.861] GetExitCodeProcess (in: hProcess=0x7f8, lpExitCode=0x2660b00 | out: lpExitCode=0x2660b00*=0x103) returned 1 [0058.861] GetLastError () returned 0x0 [0058.861] CheckRemoteDebuggerPresent (in: hProcess=0x7f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.861] GetLastError () returned 0x0 [0058.861] GetCurrentProcessId () returned 0x13cc [0058.861] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x7fc [0058.861] GetLastError () returned 0x0 [0058.861] GetExitCodeProcess (in: hProcess=0x7fc, lpExitCode=0x2660bb4 | out: lpExitCode=0x2660bb4*=0x103) returned 1 [0058.861] GetLastError () returned 0x0 [0058.861] CheckRemoteDebuggerPresent (in: hProcess=0x7fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.861] GetLastError () returned 0x0 [0058.861] GetCurrentProcessId () returned 0x13cc [0058.861] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x804 [0058.862] GetLastError () returned 0x0 [0058.862] GetExitCodeProcess (in: hProcess=0x804, lpExitCode=0x2660c68 | out: lpExitCode=0x2660c68*=0x103) returned 1 [0058.862] GetLastError () returned 0x0 [0058.862] CheckRemoteDebuggerPresent (in: hProcess=0x804, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.862] GetLastError () returned 0x0 [0058.862] GetCurrentProcessId () returned 0x13cc [0058.862] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x808 [0058.862] GetLastError () returned 0x0 [0058.862] GetExitCodeProcess (in: hProcess=0x808, lpExitCode=0x2660d1c | out: lpExitCode=0x2660d1c*=0x103) returned 1 [0058.862] GetLastError () returned 0x0 [0058.862] CheckRemoteDebuggerPresent (in: hProcess=0x808, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.862] GetLastError () returned 0x0 [0058.862] GetCurrentProcessId () returned 0x13cc [0058.862] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x80c [0058.862] GetLastError () returned 0x0 [0058.862] GetExitCodeProcess (in: hProcess=0x80c, lpExitCode=0x2660dd0 | out: lpExitCode=0x2660dd0*=0x103) returned 1 [0058.862] GetLastError () returned 0x0 [0058.862] CheckRemoteDebuggerPresent (in: hProcess=0x80c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.862] GetLastError () returned 0x0 [0058.862] GetCurrentProcessId () returned 0x13cc [0058.863] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x810 [0058.863] GetLastError () returned 0x0 [0058.863] GetExitCodeProcess (in: hProcess=0x810, lpExitCode=0x2660e84 | out: lpExitCode=0x2660e84*=0x103) returned 1 [0058.863] GetLastError () returned 0x0 [0058.863] CheckRemoteDebuggerPresent (in: hProcess=0x810, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.863] GetLastError () returned 0x0 [0058.863] GetCurrentProcessId () returned 0x13cc [0058.863] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x814 [0058.863] GetLastError () returned 0x0 [0058.863] GetExitCodeProcess (in: hProcess=0x814, lpExitCode=0x2660f38 | out: lpExitCode=0x2660f38*=0x103) returned 1 [0058.863] GetLastError () returned 0x0 [0058.863] CheckRemoteDebuggerPresent (in: hProcess=0x814, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.863] GetLastError () returned 0x0 [0058.863] GetCurrentProcessId () returned 0x13cc [0058.863] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x818 [0058.863] GetLastError () returned 0x0 [0058.863] GetExitCodeProcess (in: hProcess=0x818, lpExitCode=0x2660fec | out: lpExitCode=0x2660fec*=0x103) returned 1 [0058.863] GetLastError () returned 0x0 [0058.863] CheckRemoteDebuggerPresent (in: hProcess=0x818, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.863] GetLastError () returned 0x0 [0058.864] GetCurrentProcessId () returned 0x13cc [0058.864] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x81c [0058.864] GetLastError () returned 0x0 [0058.864] GetExitCodeProcess (in: hProcess=0x81c, lpExitCode=0x26610a0 | out: lpExitCode=0x26610a0*=0x103) returned 1 [0058.864] GetLastError () returned 0x0 [0058.864] CheckRemoteDebuggerPresent (in: hProcess=0x81c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.864] GetLastError () returned 0x0 [0058.864] GetCurrentProcessId () returned 0x13cc [0058.864] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x820 [0058.864] GetLastError () returned 0x0 [0058.864] GetExitCodeProcess (in: hProcess=0x820, lpExitCode=0x2661154 | out: lpExitCode=0x2661154*=0x103) returned 1 [0058.864] GetLastError () returned 0x0 [0058.864] CheckRemoteDebuggerPresent (in: hProcess=0x820, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.864] GetLastError () returned 0x0 [0058.864] GetCurrentProcessId () returned 0x13cc [0058.864] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x824 [0058.864] GetLastError () returned 0x0 [0058.864] GetExitCodeProcess (in: hProcess=0x824, lpExitCode=0x2661208 | out: lpExitCode=0x2661208*=0x103) returned 1 [0058.864] GetLastError () returned 0x0 [0058.864] CheckRemoteDebuggerPresent (in: hProcess=0x824, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.865] GetLastError () returned 0x0 [0058.865] GetCurrentProcessId () returned 0x13cc [0058.865] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x828 [0058.865] GetLastError () returned 0x0 [0058.865] GetExitCodeProcess (in: hProcess=0x828, lpExitCode=0x26612bc | out: lpExitCode=0x26612bc*=0x103) returned 1 [0058.865] GetLastError () returned 0x0 [0058.865] CheckRemoteDebuggerPresent (in: hProcess=0x828, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.865] GetLastError () returned 0x0 [0058.865] GetCurrentProcessId () returned 0x13cc [0058.865] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x82c [0058.865] GetLastError () returned 0x0 [0058.865] GetExitCodeProcess (in: hProcess=0x82c, lpExitCode=0x2661370 | out: lpExitCode=0x2661370*=0x103) returned 1 [0058.865] GetLastError () returned 0x0 [0058.865] CheckRemoteDebuggerPresent (in: hProcess=0x82c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.865] GetLastError () returned 0x0 [0058.865] GetCurrentProcessId () returned 0x13cc [0058.865] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x830 [0058.865] GetLastError () returned 0x0 [0058.865] GetExitCodeProcess (in: hProcess=0x830, lpExitCode=0x2661424 | out: lpExitCode=0x2661424*=0x103) returned 1 [0058.865] GetLastError () returned 0x0 [0058.866] CheckRemoteDebuggerPresent (in: hProcess=0x830, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.866] GetLastError () returned 0x0 [0058.866] GetCurrentProcessId () returned 0x13cc [0058.866] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x834 [0058.866] GetLastError () returned 0x0 [0058.866] GetExitCodeProcess (in: hProcess=0x834, lpExitCode=0x26614d8 | out: lpExitCode=0x26614d8*=0x103) returned 1 [0058.866] GetLastError () returned 0x0 [0058.866] CheckRemoteDebuggerPresent (in: hProcess=0x834, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.866] GetLastError () returned 0x0 [0058.866] GetCurrentProcessId () returned 0x13cc [0058.866] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x838 [0058.866] GetLastError () returned 0x0 [0058.866] GetExitCodeProcess (in: hProcess=0x838, lpExitCode=0x266158c | out: lpExitCode=0x266158c*=0x103) returned 1 [0058.866] GetLastError () returned 0x0 [0058.866] CheckRemoteDebuggerPresent (in: hProcess=0x838, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.866] GetLastError () returned 0x0 [0058.866] GetCurrentProcessId () returned 0x13cc [0058.866] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x83c [0058.866] GetLastError () returned 0x0 [0058.867] GetExitCodeProcess (in: hProcess=0x83c, lpExitCode=0x2661640 | out: lpExitCode=0x2661640*=0x103) returned 1 [0058.867] GetLastError () returned 0x0 [0058.867] CheckRemoteDebuggerPresent (in: hProcess=0x83c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.867] GetLastError () returned 0x0 [0058.867] GetCurrentProcessId () returned 0x13cc [0058.867] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x840 [0058.867] GetLastError () returned 0x0 [0058.867] GetExitCodeProcess (in: hProcess=0x840, lpExitCode=0x26616f4 | out: lpExitCode=0x26616f4*=0x103) returned 1 [0058.867] GetLastError () returned 0x0 [0058.867] CheckRemoteDebuggerPresent (in: hProcess=0x840, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.867] GetLastError () returned 0x0 [0058.867] GetCurrentProcessId () returned 0x13cc [0058.867] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x844 [0058.867] GetLastError () returned 0x0 [0058.867] GetExitCodeProcess (in: hProcess=0x844, lpExitCode=0x26617a8 | out: lpExitCode=0x26617a8*=0x103) returned 1 [0058.867] GetLastError () returned 0x0 [0058.867] CheckRemoteDebuggerPresent (in: hProcess=0x844, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.867] GetLastError () returned 0x0 [0058.867] GetCurrentProcessId () returned 0x13cc [0058.867] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x848 [0058.868] GetLastError () returned 0x0 [0058.868] GetExitCodeProcess (in: hProcess=0x848, lpExitCode=0x266185c | out: lpExitCode=0x266185c*=0x103) returned 1 [0058.868] GetLastError () returned 0x0 [0058.868] CheckRemoteDebuggerPresent (in: hProcess=0x848, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.868] GetLastError () returned 0x0 [0058.868] GetCurrentProcessId () returned 0x13cc [0058.868] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x84c [0058.868] GetLastError () returned 0x0 [0058.868] GetExitCodeProcess (in: hProcess=0x84c, lpExitCode=0x2661910 | out: lpExitCode=0x2661910*=0x103) returned 1 [0058.868] GetLastError () returned 0x0 [0058.868] CheckRemoteDebuggerPresent (in: hProcess=0x84c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.868] GetLastError () returned 0x0 [0058.868] GetCurrentProcessId () returned 0x13cc [0058.868] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x850 [0058.868] GetLastError () returned 0x0 [0058.868] GetExitCodeProcess (in: hProcess=0x850, lpExitCode=0x26619c4 | out: lpExitCode=0x26619c4*=0x103) returned 1 [0058.868] GetLastError () returned 0x0 [0058.868] CheckRemoteDebuggerPresent (in: hProcess=0x850, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.868] GetLastError () returned 0x0 [0058.868] GetCurrentProcessId () returned 0x13cc [0058.869] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x854 [0058.869] GetLastError () returned 0x0 [0058.869] GetExitCodeProcess (in: hProcess=0x854, lpExitCode=0x2661a78 | out: lpExitCode=0x2661a78*=0x103) returned 1 [0058.869] GetLastError () returned 0x0 [0058.869] CheckRemoteDebuggerPresent (in: hProcess=0x854, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.869] GetLastError () returned 0x0 [0058.869] GetCurrentProcessId () returned 0x13cc [0058.869] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x858 [0058.869] GetLastError () returned 0x0 [0058.869] GetExitCodeProcess (in: hProcess=0x858, lpExitCode=0x2661b2c | out: lpExitCode=0x2661b2c*=0x103) returned 1 [0058.869] GetLastError () returned 0x0 [0058.869] CheckRemoteDebuggerPresent (in: hProcess=0x858, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.869] GetLastError () returned 0x0 [0058.869] GetCurrentProcessId () returned 0x13cc [0058.869] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x85c [0058.869] GetLastError () returned 0x0 [0058.869] GetExitCodeProcess (in: hProcess=0x85c, lpExitCode=0x2661be0 | out: lpExitCode=0x2661be0*=0x103) returned 1 [0058.869] GetLastError () returned 0x0 [0058.869] CheckRemoteDebuggerPresent (in: hProcess=0x85c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.869] GetLastError () returned 0x0 [0058.870] GetCurrentProcessId () returned 0x13cc [0058.870] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x860 [0058.870] GetLastError () returned 0x0 [0058.870] GetExitCodeProcess (in: hProcess=0x860, lpExitCode=0x2661c94 | out: lpExitCode=0x2661c94*=0x103) returned 1 [0058.870] GetLastError () returned 0x0 [0058.870] CheckRemoteDebuggerPresent (in: hProcess=0x860, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.870] GetLastError () returned 0x0 [0058.870] GetCurrentProcessId () returned 0x13cc [0058.870] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x864 [0058.870] GetLastError () returned 0x0 [0058.870] GetExitCodeProcess (in: hProcess=0x864, lpExitCode=0x2661d48 | out: lpExitCode=0x2661d48*=0x103) returned 1 [0058.871] GetLastError () returned 0x0 [0058.871] CheckRemoteDebuggerPresent (in: hProcess=0x864, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.871] GetLastError () returned 0x0 [0058.871] GetCurrentProcessId () returned 0x13cc [0058.871] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x868 [0058.871] GetLastError () returned 0x0 [0058.871] GetExitCodeProcess (in: hProcess=0x868, lpExitCode=0x2661dfc | out: lpExitCode=0x2661dfc*=0x103) returned 1 [0058.871] GetLastError () returned 0x0 [0058.871] CheckRemoteDebuggerPresent (in: hProcess=0x868, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.872] GetLastError () returned 0x0 [0058.872] GetCurrentProcessId () returned 0x13cc [0058.872] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x86c [0058.872] GetLastError () returned 0x0 [0058.872] GetExitCodeProcess (in: hProcess=0x86c, lpExitCode=0x2661eb0 | out: lpExitCode=0x2661eb0*=0x103) returned 1 [0058.872] GetLastError () returned 0x0 [0058.872] CheckRemoteDebuggerPresent (in: hProcess=0x86c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.872] GetLastError () returned 0x0 [0058.872] GetCurrentProcessId () returned 0x13cc [0058.872] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x870 [0058.872] GetLastError () returned 0x0 [0058.872] GetExitCodeProcess (in: hProcess=0x870, lpExitCode=0x2661f64 | out: lpExitCode=0x2661f64*=0x103) returned 1 [0058.872] GetLastError () returned 0x0 [0058.872] CheckRemoteDebuggerPresent (in: hProcess=0x870, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.872] GetLastError () returned 0x0 [0058.873] GetCurrentProcessId () returned 0x13cc [0058.873] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x874 [0058.873] GetLastError () returned 0x0 [0058.873] GetExitCodeProcess (in: hProcess=0x874, lpExitCode=0x2662018 | out: lpExitCode=0x2662018*=0x103) returned 1 [0058.873] GetLastError () returned 0x0 [0058.873] CheckRemoteDebuggerPresent (in: hProcess=0x874, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.873] GetLastError () returned 0x0 [0058.873] GetCurrentProcessId () returned 0x13cc [0058.873] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x878 [0058.873] GetLastError () returned 0x0 [0058.873] GetExitCodeProcess (in: hProcess=0x878, lpExitCode=0x26620cc | out: lpExitCode=0x26620cc*=0x103) returned 1 [0058.873] GetLastError () returned 0x0 [0058.873] CheckRemoteDebuggerPresent (in: hProcess=0x878, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.873] GetLastError () returned 0x0 [0058.873] GetCurrentProcessId () returned 0x13cc [0058.874] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x87c [0058.874] GetLastError () returned 0x0 [0058.874] GetExitCodeProcess (in: hProcess=0x87c, lpExitCode=0x2662180 | out: lpExitCode=0x2662180*=0x103) returned 1 [0058.874] GetLastError () returned 0x0 [0058.874] CheckRemoteDebuggerPresent (in: hProcess=0x87c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.874] GetLastError () returned 0x0 [0058.874] GetCurrentProcessId () returned 0x13cc [0058.874] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x880 [0058.874] GetLastError () returned 0x0 [0058.874] GetExitCodeProcess (in: hProcess=0x880, lpExitCode=0x2662234 | out: lpExitCode=0x2662234*=0x103) returned 1 [0058.874] GetLastError () returned 0x0 [0058.874] CheckRemoteDebuggerPresent (in: hProcess=0x880, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.874] GetLastError () returned 0x0 [0058.874] GetCurrentProcessId () returned 0x13cc [0058.874] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x884 [0058.874] GetLastError () returned 0x0 [0058.874] GetExitCodeProcess (in: hProcess=0x884, lpExitCode=0x26622e8 | out: lpExitCode=0x26622e8*=0x103) returned 1 [0058.874] GetLastError () returned 0x0 [0058.874] CheckRemoteDebuggerPresent (in: hProcess=0x884, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.875] GetLastError () returned 0x0 [0058.875] GetCurrentProcessId () returned 0x13cc [0058.875] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x888 [0058.875] GetLastError () returned 0x0 [0058.875] GetExitCodeProcess (in: hProcess=0x888, lpExitCode=0x266239c | out: lpExitCode=0x266239c*=0x103) returned 1 [0058.875] GetLastError () returned 0x0 [0058.875] CheckRemoteDebuggerPresent (in: hProcess=0x888, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.875] GetLastError () returned 0x0 [0058.875] GetCurrentProcessId () returned 0x13cc [0058.875] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x88c [0058.875] GetLastError () returned 0x0 [0058.875] GetExitCodeProcess (in: hProcess=0x88c, lpExitCode=0x2662450 | out: lpExitCode=0x2662450*=0x103) returned 1 [0058.875] GetLastError () returned 0x0 [0058.875] CheckRemoteDebuggerPresent (in: hProcess=0x88c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.875] GetLastError () returned 0x0 [0058.875] GetCurrentProcessId () returned 0x13cc [0058.875] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x890 [0058.875] GetLastError () returned 0x0 [0058.875] GetExitCodeProcess (in: hProcess=0x890, lpExitCode=0x2662504 | out: lpExitCode=0x2662504*=0x103) returned 1 [0058.875] GetLastError () returned 0x0 [0058.876] CheckRemoteDebuggerPresent (in: hProcess=0x890, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.876] GetLastError () returned 0x0 [0058.876] GetCurrentProcessId () returned 0x13cc [0058.876] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x894 [0058.876] GetLastError () returned 0x0 [0058.876] GetExitCodeProcess (in: hProcess=0x894, lpExitCode=0x26625b8 | out: lpExitCode=0x26625b8*=0x103) returned 1 [0058.876] GetLastError () returned 0x0 [0058.876] CheckRemoteDebuggerPresent (in: hProcess=0x894, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.876] GetLastError () returned 0x0 [0058.876] GetCurrentProcessId () returned 0x13cc [0058.876] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x898 [0058.876] GetLastError () returned 0x0 [0058.876] GetExitCodeProcess (in: hProcess=0x898, lpExitCode=0x266266c | out: lpExitCode=0x266266c*=0x103) returned 1 [0058.876] GetLastError () returned 0x0 [0058.876] CheckRemoteDebuggerPresent (in: hProcess=0x898, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.876] GetLastError () returned 0x0 [0058.876] GetCurrentProcessId () returned 0x13cc [0058.876] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x89c [0058.876] GetLastError () returned 0x0 [0058.876] GetExitCodeProcess (in: hProcess=0x89c, lpExitCode=0x2662720 | out: lpExitCode=0x2662720*=0x103) returned 1 [0058.877] GetLastError () returned 0x0 [0058.877] CheckRemoteDebuggerPresent (in: hProcess=0x89c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.877] GetLastError () returned 0x0 [0058.877] GetCurrentProcessId () returned 0x13cc [0058.877] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8a0 [0058.877] GetLastError () returned 0x0 [0058.877] GetExitCodeProcess (in: hProcess=0x8a0, lpExitCode=0x26627d4 | out: lpExitCode=0x26627d4*=0x103) returned 1 [0058.877] GetLastError () returned 0x0 [0058.877] CheckRemoteDebuggerPresent (in: hProcess=0x8a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.877] GetLastError () returned 0x0 [0058.877] GetCurrentProcessId () returned 0x13cc [0058.877] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8a4 [0058.877] GetLastError () returned 0x0 [0058.877] GetExitCodeProcess (in: hProcess=0x8a4, lpExitCode=0x2662888 | out: lpExitCode=0x2662888*=0x103) returned 1 [0058.877] GetLastError () returned 0x0 [0058.877] CheckRemoteDebuggerPresent (in: hProcess=0x8a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.877] GetLastError () returned 0x0 [0058.877] GetCurrentProcessId () returned 0x13cc [0058.877] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8a8 [0058.877] GetLastError () returned 0x0 [0058.878] GetExitCodeProcess (in: hProcess=0x8a8, lpExitCode=0x266293c | out: lpExitCode=0x266293c*=0x103) returned 1 [0058.878] GetLastError () returned 0x0 [0058.878] CheckRemoteDebuggerPresent (in: hProcess=0x8a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.878] GetLastError () returned 0x0 [0058.878] GetCurrentProcessId () returned 0x13cc [0058.878] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8ac [0058.878] GetLastError () returned 0x0 [0058.878] GetExitCodeProcess (in: hProcess=0x8ac, lpExitCode=0x26629f0 | out: lpExitCode=0x26629f0*=0x103) returned 1 [0058.878] GetLastError () returned 0x0 [0058.878] CheckRemoteDebuggerPresent (in: hProcess=0x8ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.878] GetLastError () returned 0x0 [0058.878] GetCurrentProcessId () returned 0x13cc [0058.878] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8b0 [0058.878] GetLastError () returned 0x0 [0058.878] GetExitCodeProcess (in: hProcess=0x8b0, lpExitCode=0x2662aa4 | out: lpExitCode=0x2662aa4*=0x103) returned 1 [0058.878] GetLastError () returned 0x0 [0058.878] CheckRemoteDebuggerPresent (in: hProcess=0x8b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.878] GetLastError () returned 0x0 [0058.878] GetCurrentProcessId () returned 0x13cc [0058.879] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8b4 [0058.879] GetLastError () returned 0x0 [0058.879] GetExitCodeProcess (in: hProcess=0x8b4, lpExitCode=0x2662b58 | out: lpExitCode=0x2662b58*=0x103) returned 1 [0058.879] GetLastError () returned 0x0 [0058.879] CheckRemoteDebuggerPresent (in: hProcess=0x8b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.879] GetLastError () returned 0x0 [0058.879] GetCurrentProcessId () returned 0x13cc [0058.879] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8b8 [0058.879] GetLastError () returned 0x0 [0058.879] GetExitCodeProcess (in: hProcess=0x8b8, lpExitCode=0x2662c0c | out: lpExitCode=0x2662c0c*=0x103) returned 1 [0058.879] GetLastError () returned 0x0 [0058.879] CheckRemoteDebuggerPresent (in: hProcess=0x8b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.879] GetLastError () returned 0x0 [0058.879] GetCurrentProcessId () returned 0x13cc [0058.879] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8bc [0058.879] GetLastError () returned 0x0 [0058.879] GetExitCodeProcess (in: hProcess=0x8bc, lpExitCode=0x2662cc0 | out: lpExitCode=0x2662cc0*=0x103) returned 1 [0058.879] GetLastError () returned 0x0 [0058.879] CheckRemoteDebuggerPresent (in: hProcess=0x8bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.879] GetLastError () returned 0x0 [0058.880] GetCurrentProcessId () returned 0x13cc [0058.880] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8c0 [0058.880] GetLastError () returned 0x0 [0058.880] GetExitCodeProcess (in: hProcess=0x8c0, lpExitCode=0x2662d74 | out: lpExitCode=0x2662d74*=0x103) returned 1 [0058.880] GetLastError () returned 0x0 [0058.880] CheckRemoteDebuggerPresent (in: hProcess=0x8c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.880] GetLastError () returned 0x0 [0058.880] GetCurrentProcessId () returned 0x13cc [0058.880] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8c4 [0058.880] GetLastError () returned 0x0 [0058.880] GetExitCodeProcess (in: hProcess=0x8c4, lpExitCode=0x2662e28 | out: lpExitCode=0x2662e28*=0x103) returned 1 [0058.880] GetLastError () returned 0x0 [0058.880] CheckRemoteDebuggerPresent (in: hProcess=0x8c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.880] GetLastError () returned 0x0 [0058.880] GetCurrentProcessId () returned 0x13cc [0058.880] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8c8 [0058.880] GetLastError () returned 0x0 [0058.880] GetExitCodeProcess (in: hProcess=0x8c8, lpExitCode=0x2662edc | out: lpExitCode=0x2662edc*=0x103) returned 1 [0058.880] GetLastError () returned 0x0 [0058.880] CheckRemoteDebuggerPresent (in: hProcess=0x8c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.881] GetLastError () returned 0x0 [0058.881] GetCurrentProcessId () returned 0x13cc [0058.881] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8cc [0058.881] GetLastError () returned 0x0 [0058.881] GetExitCodeProcess (in: hProcess=0x8cc, lpExitCode=0x2662f90 | out: lpExitCode=0x2662f90*=0x103) returned 1 [0058.881] GetLastError () returned 0x0 [0058.881] CheckRemoteDebuggerPresent (in: hProcess=0x8cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.881] GetLastError () returned 0x0 [0058.881] GetCurrentProcessId () returned 0x13cc [0058.881] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8d0 [0058.881] GetLastError () returned 0x0 [0058.881] GetExitCodeProcess (in: hProcess=0x8d0, lpExitCode=0x2663044 | out: lpExitCode=0x2663044*=0x103) returned 1 [0058.881] GetLastError () returned 0x0 [0058.881] CheckRemoteDebuggerPresent (in: hProcess=0x8d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.881] GetLastError () returned 0x0 [0058.881] GetCurrentProcessId () returned 0x13cc [0058.881] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8d4 [0058.881] GetLastError () returned 0x0 [0058.882] GetExitCodeProcess (in: hProcess=0x8d4, lpExitCode=0x26630f8 | out: lpExitCode=0x26630f8*=0x103) returned 1 [0058.882] GetLastError () returned 0x0 [0058.882] CheckRemoteDebuggerPresent (in: hProcess=0x8d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.882] GetLastError () returned 0x0 [0058.882] GetCurrentProcessId () returned 0x13cc [0058.882] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8d8 [0058.882] GetLastError () returned 0x0 [0058.882] GetExitCodeProcess (in: hProcess=0x8d8, lpExitCode=0x26631ac | out: lpExitCode=0x26631ac*=0x103) returned 1 [0058.882] GetLastError () returned 0x0 [0058.882] CheckRemoteDebuggerPresent (in: hProcess=0x8d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.882] GetLastError () returned 0x0 [0058.882] GetCurrentProcessId () returned 0x13cc [0058.882] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8dc [0058.882] GetLastError () returned 0x0 [0058.882] GetExitCodeProcess (in: hProcess=0x8dc, lpExitCode=0x2663260 | out: lpExitCode=0x2663260*=0x103) returned 1 [0058.882] GetLastError () returned 0x0 [0058.882] CheckRemoteDebuggerPresent (in: hProcess=0x8dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.882] GetLastError () returned 0x0 [0058.883] GetCurrentProcessId () returned 0x13cc [0058.883] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8e0 [0058.883] GetLastError () returned 0x0 [0058.883] GetExitCodeProcess (in: hProcess=0x8e0, lpExitCode=0x2663314 | out: lpExitCode=0x2663314*=0x103) returned 1 [0058.883] GetLastError () returned 0x0 [0058.883] CheckRemoteDebuggerPresent (in: hProcess=0x8e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.883] GetLastError () returned 0x0 [0058.883] GetCurrentProcessId () returned 0x13cc [0058.883] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8e4 [0058.883] GetLastError () returned 0x0 [0058.883] GetExitCodeProcess (in: hProcess=0x8e4, lpExitCode=0x26633c8 | out: lpExitCode=0x26633c8*=0x103) returned 1 [0058.883] GetLastError () returned 0x0 [0058.883] CheckRemoteDebuggerPresent (in: hProcess=0x8e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.883] GetLastError () returned 0x0 [0058.883] GetCurrentProcessId () returned 0x13cc [0058.884] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8e8 [0058.884] GetLastError () returned 0x0 [0058.884] GetExitCodeProcess (in: hProcess=0x8e8, lpExitCode=0x266347c | out: lpExitCode=0x266347c*=0x103) returned 1 [0058.884] GetLastError () returned 0x0 [0058.884] CheckRemoteDebuggerPresent (in: hProcess=0x8e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.884] GetLastError () returned 0x0 [0058.884] GetCurrentProcessId () returned 0x13cc [0058.884] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8ec [0058.884] GetLastError () returned 0x0 [0058.884] GetExitCodeProcess (in: hProcess=0x8ec, lpExitCode=0x2663530 | out: lpExitCode=0x2663530*=0x103) returned 1 [0058.884] GetLastError () returned 0x0 [0058.884] CheckRemoteDebuggerPresent (in: hProcess=0x8ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.884] GetLastError () returned 0x0 [0058.884] GetCurrentProcessId () returned 0x13cc [0058.884] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8f0 [0058.885] GetLastError () returned 0x0 [0058.885] GetExitCodeProcess (in: hProcess=0x8f0, lpExitCode=0x26635e4 | out: lpExitCode=0x26635e4*=0x103) returned 1 [0058.885] GetLastError () returned 0x0 [0058.885] CheckRemoteDebuggerPresent (in: hProcess=0x8f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.885] GetLastError () returned 0x0 [0058.885] GetCurrentProcessId () returned 0x13cc [0058.885] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8f4 [0058.885] GetLastError () returned 0x0 [0058.885] GetExitCodeProcess (in: hProcess=0x8f4, lpExitCode=0x2663698 | out: lpExitCode=0x2663698*=0x103) returned 1 [0058.885] GetLastError () returned 0x0 [0058.885] CheckRemoteDebuggerPresent (in: hProcess=0x8f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.885] GetLastError () returned 0x0 [0058.885] GetCurrentProcessId () returned 0x13cc [0058.885] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8f8 [0058.885] GetLastError () returned 0x0 [0058.886] GetExitCodeProcess (in: hProcess=0x8f8, lpExitCode=0x266374c | out: lpExitCode=0x266374c*=0x103) returned 1 [0058.886] GetLastError () returned 0x0 [0058.886] CheckRemoteDebuggerPresent (in: hProcess=0x8f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.886] GetLastError () returned 0x0 [0058.886] GetCurrentProcessId () returned 0x13cc [0058.886] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x8fc [0058.886] GetLastError () returned 0x0 [0058.886] GetExitCodeProcess (in: hProcess=0x8fc, lpExitCode=0x2663800 | out: lpExitCode=0x2663800*=0x103) returned 1 [0058.886] GetLastError () returned 0x0 [0058.886] CheckRemoteDebuggerPresent (in: hProcess=0x8fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.887] GetLastError () returned 0x0 [0058.887] GetCurrentProcessId () returned 0x13cc [0058.887] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x900 [0058.887] GetLastError () returned 0x0 [0058.887] GetExitCodeProcess (in: hProcess=0x900, lpExitCode=0x26638b4 | out: lpExitCode=0x26638b4*=0x103) returned 1 [0058.887] GetLastError () returned 0x0 [0058.887] CheckRemoteDebuggerPresent (in: hProcess=0x900, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.887] GetLastError () returned 0x0 [0058.887] GetCurrentProcessId () returned 0x13cc [0058.887] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x904 [0058.887] GetLastError () returned 0x0 [0058.887] GetExitCodeProcess (in: hProcess=0x904, lpExitCode=0x2663968 | out: lpExitCode=0x2663968*=0x103) returned 1 [0058.887] GetLastError () returned 0x0 [0058.887] CheckRemoteDebuggerPresent (in: hProcess=0x904, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.888] GetLastError () returned 0x0 [0058.888] GetCurrentProcessId () returned 0x13cc [0058.888] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x908 [0058.888] GetLastError () returned 0x0 [0058.888] GetExitCodeProcess (in: hProcess=0x908, lpExitCode=0x2663a1c | out: lpExitCode=0x2663a1c*=0x103) returned 1 [0058.888] GetLastError () returned 0x0 [0058.888] CheckRemoteDebuggerPresent (in: hProcess=0x908, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.888] GetLastError () returned 0x0 [0058.888] GetCurrentProcessId () returned 0x13cc [0058.888] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x90c [0058.888] GetLastError () returned 0x0 [0058.888] GetExitCodeProcess (in: hProcess=0x90c, lpExitCode=0x2663ad0 | out: lpExitCode=0x2663ad0*=0x103) returned 1 [0058.888] GetLastError () returned 0x0 [0058.888] CheckRemoteDebuggerPresent (in: hProcess=0x90c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.888] GetLastError () returned 0x0 [0058.888] GetCurrentProcessId () returned 0x13cc [0058.889] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x910 [0058.889] GetLastError () returned 0x0 [0058.889] GetExitCodeProcess (in: hProcess=0x910, lpExitCode=0x2663b84 | out: lpExitCode=0x2663b84*=0x103) returned 1 [0058.889] GetLastError () returned 0x0 [0058.889] CheckRemoteDebuggerPresent (in: hProcess=0x910, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.889] GetLastError () returned 0x0 [0058.889] GetCurrentProcessId () returned 0x13cc [0058.889] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x914 [0058.889] GetLastError () returned 0x0 [0058.889] GetExitCodeProcess (in: hProcess=0x914, lpExitCode=0x2663c38 | out: lpExitCode=0x2663c38*=0x103) returned 1 [0058.889] GetLastError () returned 0x0 [0058.889] CheckRemoteDebuggerPresent (in: hProcess=0x914, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.889] GetLastError () returned 0x0 [0058.889] GetCurrentProcessId () returned 0x13cc [0058.889] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x918 [0058.889] GetLastError () returned 0x0 [0058.890] GetExitCodeProcess (in: hProcess=0x918, lpExitCode=0x2663cec | out: lpExitCode=0x2663cec*=0x103) returned 1 [0058.890] GetLastError () returned 0x0 [0058.890] CheckRemoteDebuggerPresent (in: hProcess=0x918, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.890] GetLastError () returned 0x0 [0058.890] GetCurrentProcessId () returned 0x13cc [0058.890] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x91c [0058.890] GetLastError () returned 0x0 [0058.890] GetExitCodeProcess (in: hProcess=0x91c, lpExitCode=0x2663da0 | out: lpExitCode=0x2663da0*=0x103) returned 1 [0058.890] GetLastError () returned 0x0 [0058.890] CheckRemoteDebuggerPresent (in: hProcess=0x91c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.890] GetLastError () returned 0x0 [0058.890] GetCurrentProcessId () returned 0x13cc [0058.890] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x920 [0058.890] GetLastError () returned 0x0 [0058.891] GetExitCodeProcess (in: hProcess=0x920, lpExitCode=0x2663e54 | out: lpExitCode=0x2663e54*=0x103) returned 1 [0058.891] GetLastError () returned 0x0 [0058.891] CheckRemoteDebuggerPresent (in: hProcess=0x920, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.891] GetLastError () returned 0x0 [0058.891] GetCurrentProcessId () returned 0x13cc [0058.891] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x924 [0058.891] GetLastError () returned 0x0 [0058.891] GetExitCodeProcess (in: hProcess=0x924, lpExitCode=0x2663f08 | out: lpExitCode=0x2663f08*=0x103) returned 1 [0058.891] GetLastError () returned 0x0 [0058.891] CheckRemoteDebuggerPresent (in: hProcess=0x924, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.891] GetLastError () returned 0x0 [0058.891] GetCurrentProcessId () returned 0x13cc [0058.892] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x928 [0058.892] GetLastError () returned 0x0 [0058.892] GetExitCodeProcess (in: hProcess=0x928, lpExitCode=0x2663fbc | out: lpExitCode=0x2663fbc*=0x103) returned 1 [0058.892] GetLastError () returned 0x0 [0058.892] CheckRemoteDebuggerPresent (in: hProcess=0x928, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.892] GetLastError () returned 0x0 [0058.892] GetCurrentProcessId () returned 0x13cc [0058.892] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x92c [0058.892] GetLastError () returned 0x0 [0058.892] GetExitCodeProcess (in: hProcess=0x92c, lpExitCode=0x2664070 | out: lpExitCode=0x2664070*=0x103) returned 1 [0058.892] GetLastError () returned 0x0 [0058.892] CheckRemoteDebuggerPresent (in: hProcess=0x92c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.892] GetLastError () returned 0x0 [0058.892] GetCurrentProcessId () returned 0x13cc [0058.892] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x930 [0058.893] GetLastError () returned 0x0 [0058.893] GetExitCodeProcess (in: hProcess=0x930, lpExitCode=0x2664124 | out: lpExitCode=0x2664124*=0x103) returned 1 [0058.893] GetLastError () returned 0x0 [0058.893] CheckRemoteDebuggerPresent (in: hProcess=0x930, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.893] GetLastError () returned 0x0 [0058.893] GetCurrentProcessId () returned 0x13cc [0058.893] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x934 [0058.893] GetLastError () returned 0x0 [0058.893] GetExitCodeProcess (in: hProcess=0x934, lpExitCode=0x26641d8 | out: lpExitCode=0x26641d8*=0x103) returned 1 [0058.893] GetLastError () returned 0x0 [0058.893] CheckRemoteDebuggerPresent (in: hProcess=0x934, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.893] GetLastError () returned 0x0 [0058.893] GetCurrentProcessId () returned 0x13cc [0058.893] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x938 [0058.893] GetLastError () returned 0x0 [0058.893] GetExitCodeProcess (in: hProcess=0x938, lpExitCode=0x266428c | out: lpExitCode=0x266428c*=0x103) returned 1 [0058.893] GetLastError () returned 0x0 [0058.894] CheckRemoteDebuggerPresent (in: hProcess=0x938, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.894] GetLastError () returned 0x0 [0058.894] GetCurrentProcessId () returned 0x13cc [0058.894] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x93c [0058.894] GetLastError () returned 0x0 [0058.894] GetExitCodeProcess (in: hProcess=0x93c, lpExitCode=0x2664340 | out: lpExitCode=0x2664340*=0x103) returned 1 [0058.894] GetLastError () returned 0x0 [0058.894] CheckRemoteDebuggerPresent (in: hProcess=0x93c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.894] GetLastError () returned 0x0 [0058.894] GetCurrentProcessId () returned 0x13cc [0058.894] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x940 [0058.894] GetLastError () returned 0x0 [0058.894] GetExitCodeProcess (in: hProcess=0x940, lpExitCode=0x26643f4 | out: lpExitCode=0x26643f4*=0x103) returned 1 [0058.894] GetLastError () returned 0x0 [0058.894] CheckRemoteDebuggerPresent (in: hProcess=0x940, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.894] GetLastError () returned 0x0 [0058.894] GetCurrentProcessId () returned 0x13cc [0058.895] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x944 [0058.895] GetLastError () returned 0x0 [0058.895] GetExitCodeProcess (in: hProcess=0x944, lpExitCode=0x26644a8 | out: lpExitCode=0x26644a8*=0x103) returned 1 [0058.895] GetLastError () returned 0x0 [0058.895] CheckRemoteDebuggerPresent (in: hProcess=0x944, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.895] GetLastError () returned 0x0 [0058.895] GetCurrentProcessId () returned 0x13cc [0058.895] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x948 [0058.895] GetLastError () returned 0x0 [0058.895] GetExitCodeProcess (in: hProcess=0x948, lpExitCode=0x266455c | out: lpExitCode=0x266455c*=0x103) returned 1 [0058.895] GetLastError () returned 0x0 [0058.895] CheckRemoteDebuggerPresent (in: hProcess=0x948, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.895] GetLastError () returned 0x0 [0058.895] GetCurrentProcessId () returned 0x13cc [0058.895] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x94c [0058.895] GetLastError () returned 0x0 [0058.895] GetExitCodeProcess (in: hProcess=0x94c, lpExitCode=0x2664610 | out: lpExitCode=0x2664610*=0x103) returned 1 [0058.895] GetLastError () returned 0x0 [0058.896] CheckRemoteDebuggerPresent (in: hProcess=0x94c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.896] GetLastError () returned 0x0 [0058.896] GetCurrentProcessId () returned 0x13cc [0058.896] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x950 [0058.896] GetLastError () returned 0x0 [0058.896] GetExitCodeProcess (in: hProcess=0x950, lpExitCode=0x26646c4 | out: lpExitCode=0x26646c4*=0x103) returned 1 [0058.896] GetLastError () returned 0x0 [0058.896] CheckRemoteDebuggerPresent (in: hProcess=0x950, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.896] GetLastError () returned 0x0 [0058.896] GetCurrentProcessId () returned 0x13cc [0058.896] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x954 [0058.896] GetLastError () returned 0x0 [0058.896] GetExitCodeProcess (in: hProcess=0x954, lpExitCode=0x2664778 | out: lpExitCode=0x2664778*=0x103) returned 1 [0058.896] GetLastError () returned 0x0 [0058.896] CheckRemoteDebuggerPresent (in: hProcess=0x954, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.896] GetLastError () returned 0x0 [0058.896] GetCurrentProcessId () returned 0x13cc [0058.896] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x958 [0058.896] GetLastError () returned 0x0 [0058.897] GetExitCodeProcess (in: hProcess=0x958, lpExitCode=0x266482c | out: lpExitCode=0x266482c*=0x103) returned 1 [0058.897] GetLastError () returned 0x0 [0058.897] CheckRemoteDebuggerPresent (in: hProcess=0x958, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.897] GetLastError () returned 0x0 [0058.897] GetCurrentProcessId () returned 0x13cc [0058.897] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x95c [0058.897] GetLastError () returned 0x0 [0058.897] GetExitCodeProcess (in: hProcess=0x95c, lpExitCode=0x26648e0 | out: lpExitCode=0x26648e0*=0x103) returned 1 [0058.897] GetLastError () returned 0x0 [0058.897] CheckRemoteDebuggerPresent (in: hProcess=0x95c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.897] GetLastError () returned 0x0 [0058.897] GetCurrentProcessId () returned 0x13cc [0058.897] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x960 [0058.897] GetLastError () returned 0x0 [0058.897] GetExitCodeProcess (in: hProcess=0x960, lpExitCode=0x2664994 | out: lpExitCode=0x2664994*=0x103) returned 1 [0058.897] GetLastError () returned 0x0 [0058.898] CheckRemoteDebuggerPresent (in: hProcess=0x960, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.898] GetLastError () returned 0x0 [0058.898] GetCurrentProcessId () returned 0x13cc [0058.898] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x964 [0058.898] GetLastError () returned 0x0 [0058.898] GetExitCodeProcess (in: hProcess=0x964, lpExitCode=0x2664a48 | out: lpExitCode=0x2664a48*=0x103) returned 1 [0058.898] GetLastError () returned 0x0 [0058.898] CheckRemoteDebuggerPresent (in: hProcess=0x964, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.898] GetLastError () returned 0x0 [0058.898] GetCurrentProcessId () returned 0x13cc [0058.898] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x968 [0058.898] GetLastError () returned 0x0 [0058.898] GetExitCodeProcess (in: hProcess=0x968, lpExitCode=0x2664afc | out: lpExitCode=0x2664afc*=0x103) returned 1 [0058.898] GetLastError () returned 0x0 [0058.898] CheckRemoteDebuggerPresent (in: hProcess=0x968, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.898] GetLastError () returned 0x0 [0058.898] GetCurrentProcessId () returned 0x13cc [0058.899] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x96c [0058.899] GetLastError () returned 0x0 [0058.899] GetExitCodeProcess (in: hProcess=0x96c, lpExitCode=0x2664bb0 | out: lpExitCode=0x2664bb0*=0x103) returned 1 [0058.899] GetLastError () returned 0x0 [0058.899] CheckRemoteDebuggerPresent (in: hProcess=0x96c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.899] GetLastError () returned 0x0 [0058.899] GetCurrentProcessId () returned 0x13cc [0058.899] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x970 [0058.899] GetLastError () returned 0x0 [0058.899] GetExitCodeProcess (in: hProcess=0x970, lpExitCode=0x2664c64 | out: lpExitCode=0x2664c64*=0x103) returned 1 [0058.899] GetLastError () returned 0x0 [0058.899] CheckRemoteDebuggerPresent (in: hProcess=0x970, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.899] GetLastError () returned 0x0 [0058.899] GetCurrentProcessId () returned 0x13cc [0058.899] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x974 [0058.899] GetLastError () returned 0x0 [0058.899] GetExitCodeProcess (in: hProcess=0x974, lpExitCode=0x2664d18 | out: lpExitCode=0x2664d18*=0x103) returned 1 [0058.899] GetLastError () returned 0x0 [0058.899] CheckRemoteDebuggerPresent (in: hProcess=0x974, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.900] GetLastError () returned 0x0 [0058.900] GetCurrentProcessId () returned 0x13cc [0058.900] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x978 [0058.900] GetLastError () returned 0x0 [0058.900] GetExitCodeProcess (in: hProcess=0x978, lpExitCode=0x2664dcc | out: lpExitCode=0x2664dcc*=0x103) returned 1 [0058.900] GetLastError () returned 0x0 [0058.900] CheckRemoteDebuggerPresent (in: hProcess=0x978, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.900] GetLastError () returned 0x0 [0058.900] GetCurrentProcessId () returned 0x13cc [0058.900] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x97c [0058.900] GetLastError () returned 0x0 [0058.900] GetExitCodeProcess (in: hProcess=0x97c, lpExitCode=0x2664e80 | out: lpExitCode=0x2664e80*=0x103) returned 1 [0058.900] GetLastError () returned 0x0 [0058.900] CheckRemoteDebuggerPresent (in: hProcess=0x97c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.900] GetLastError () returned 0x0 [0058.900] GetCurrentProcessId () returned 0x13cc [0058.900] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x980 [0058.901] GetLastError () returned 0x0 [0058.901] GetExitCodeProcess (in: hProcess=0x980, lpExitCode=0x2664f34 | out: lpExitCode=0x2664f34*=0x103) returned 1 [0058.901] GetLastError () returned 0x0 [0058.901] CheckRemoteDebuggerPresent (in: hProcess=0x980, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.901] GetLastError () returned 0x0 [0058.901] GetCurrentProcessId () returned 0x13cc [0058.901] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x984 [0058.901] GetLastError () returned 0x0 [0058.901] GetExitCodeProcess (in: hProcess=0x984, lpExitCode=0x2664fe8 | out: lpExitCode=0x2664fe8*=0x103) returned 1 [0058.901] GetLastError () returned 0x0 [0058.901] CheckRemoteDebuggerPresent (in: hProcess=0x984, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.901] GetLastError () returned 0x0 [0058.901] GetCurrentProcessId () returned 0x13cc [0058.902] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x988 [0058.902] GetLastError () returned 0x0 [0058.902] GetExitCodeProcess (in: hProcess=0x988, lpExitCode=0x266509c | out: lpExitCode=0x266509c*=0x103) returned 1 [0058.902] GetLastError () returned 0x0 [0058.902] CheckRemoteDebuggerPresent (in: hProcess=0x988, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.902] GetLastError () returned 0x0 [0058.902] GetCurrentProcessId () returned 0x13cc [0058.902] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x98c [0058.902] GetLastError () returned 0x0 [0058.902] GetExitCodeProcess (in: hProcess=0x98c, lpExitCode=0x2665150 | out: lpExitCode=0x2665150*=0x103) returned 1 [0058.902] GetLastError () returned 0x0 [0058.902] CheckRemoteDebuggerPresent (in: hProcess=0x98c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.903] GetLastError () returned 0x0 [0058.903] GetCurrentProcessId () returned 0x13cc [0058.903] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x990 [0058.903] GetLastError () returned 0x0 [0058.903] GetExitCodeProcess (in: hProcess=0x990, lpExitCode=0x2665204 | out: lpExitCode=0x2665204*=0x103) returned 1 [0058.903] GetLastError () returned 0x0 [0058.903] CheckRemoteDebuggerPresent (in: hProcess=0x990, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.903] GetLastError () returned 0x0 [0058.903] GetCurrentProcessId () returned 0x13cc [0058.903] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x994 [0058.903] GetLastError () returned 0x0 [0058.903] GetExitCodeProcess (in: hProcess=0x994, lpExitCode=0x26652b8 | out: lpExitCode=0x26652b8*=0x103) returned 1 [0058.903] GetLastError () returned 0x0 [0058.903] CheckRemoteDebuggerPresent (in: hProcess=0x994, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.903] GetLastError () returned 0x0 [0058.903] GetCurrentProcessId () returned 0x13cc [0058.903] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x998 [0058.903] GetLastError () returned 0x0 [0058.903] GetExitCodeProcess (in: hProcess=0x998, lpExitCode=0x266536c | out: lpExitCode=0x266536c*=0x103) returned 1 [0058.904] GetLastError () returned 0x0 [0058.904] CheckRemoteDebuggerPresent (in: hProcess=0x998, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.904] GetLastError () returned 0x0 [0058.904] GetCurrentProcessId () returned 0x13cc [0058.904] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x99c [0058.904] GetLastError () returned 0x0 [0058.904] GetExitCodeProcess (in: hProcess=0x99c, lpExitCode=0x2665420 | out: lpExitCode=0x2665420*=0x103) returned 1 [0058.904] GetLastError () returned 0x0 [0058.904] CheckRemoteDebuggerPresent (in: hProcess=0x99c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.904] GetLastError () returned 0x0 [0058.904] GetCurrentProcessId () returned 0x13cc [0058.904] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9a0 [0058.904] GetLastError () returned 0x0 [0058.904] GetExitCodeProcess (in: hProcess=0x9a0, lpExitCode=0x26654d4 | out: lpExitCode=0x26654d4*=0x103) returned 1 [0058.904] GetLastError () returned 0x0 [0058.904] CheckRemoteDebuggerPresent (in: hProcess=0x9a0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.904] GetLastError () returned 0x0 [0058.904] GetCurrentProcessId () returned 0x13cc [0058.904] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9a4 [0058.905] GetLastError () returned 0x0 [0058.905] GetExitCodeProcess (in: hProcess=0x9a4, lpExitCode=0x2665588 | out: lpExitCode=0x2665588*=0x103) returned 1 [0058.905] GetLastError () returned 0x0 [0058.905] CheckRemoteDebuggerPresent (in: hProcess=0x9a4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.905] GetLastError () returned 0x0 [0058.905] GetCurrentProcessId () returned 0x13cc [0058.905] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9a8 [0058.905] GetLastError () returned 0x0 [0058.905] GetExitCodeProcess (in: hProcess=0x9a8, lpExitCode=0x266563c | out: lpExitCode=0x266563c*=0x103) returned 1 [0058.905] GetLastError () returned 0x0 [0058.905] CheckRemoteDebuggerPresent (in: hProcess=0x9a8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.905] GetLastError () returned 0x0 [0058.905] GetCurrentProcessId () returned 0x13cc [0058.905] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9ac [0058.905] GetLastError () returned 0x0 [0058.905] GetExitCodeProcess (in: hProcess=0x9ac, lpExitCode=0x26656f0 | out: lpExitCode=0x26656f0*=0x103) returned 1 [0058.906] GetLastError () returned 0x0 [0058.906] CheckRemoteDebuggerPresent (in: hProcess=0x9ac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.906] GetLastError () returned 0x0 [0058.906] GetCurrentProcessId () returned 0x13cc [0058.906] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9b0 [0058.906] GetLastError () returned 0x0 [0058.906] GetExitCodeProcess (in: hProcess=0x9b0, lpExitCode=0x26657a4 | out: lpExitCode=0x26657a4*=0x103) returned 1 [0058.906] GetLastError () returned 0x0 [0058.906] CheckRemoteDebuggerPresent (in: hProcess=0x9b0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.906] GetLastError () returned 0x0 [0058.906] GetCurrentProcessId () returned 0x13cc [0058.906] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9b4 [0058.906] GetLastError () returned 0x0 [0058.906] GetExitCodeProcess (in: hProcess=0x9b4, lpExitCode=0x2665858 | out: lpExitCode=0x2665858*=0x103) returned 1 [0058.906] GetLastError () returned 0x0 [0058.906] CheckRemoteDebuggerPresent (in: hProcess=0x9b4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.907] GetLastError () returned 0x0 [0058.907] GetCurrentProcessId () returned 0x13cc [0058.907] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9b8 [0058.907] GetLastError () returned 0x0 [0058.907] GetExitCodeProcess (in: hProcess=0x9b8, lpExitCode=0x266590c | out: lpExitCode=0x266590c*=0x103) returned 1 [0058.907] GetLastError () returned 0x0 [0058.907] CheckRemoteDebuggerPresent (in: hProcess=0x9b8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.907] GetLastError () returned 0x0 [0058.907] GetCurrentProcessId () returned 0x13cc [0058.907] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9bc [0058.907] GetLastError () returned 0x0 [0058.907] GetExitCodeProcess (in: hProcess=0x9bc, lpExitCode=0x26659c0 | out: lpExitCode=0x26659c0*=0x103) returned 1 [0058.907] GetLastError () returned 0x0 [0058.907] CheckRemoteDebuggerPresent (in: hProcess=0x9bc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.907] GetLastError () returned 0x0 [0058.908] GetCurrentProcessId () returned 0x13cc [0058.908] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9c0 [0058.908] GetLastError () returned 0x0 [0058.908] GetExitCodeProcess (in: hProcess=0x9c0, lpExitCode=0x2665a74 | out: lpExitCode=0x2665a74*=0x103) returned 1 [0058.908] GetLastError () returned 0x0 [0058.908] CheckRemoteDebuggerPresent (in: hProcess=0x9c0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.908] GetLastError () returned 0x0 [0058.908] GetCurrentProcessId () returned 0x13cc [0058.908] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9c4 [0058.908] GetLastError () returned 0x0 [0058.908] GetExitCodeProcess (in: hProcess=0x9c4, lpExitCode=0x2665b28 | out: lpExitCode=0x2665b28*=0x103) returned 1 [0058.908] GetLastError () returned 0x0 [0058.908] CheckRemoteDebuggerPresent (in: hProcess=0x9c4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.908] GetLastError () returned 0x0 [0058.908] GetCurrentProcessId () returned 0x13cc [0058.908] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9c8 [0058.908] GetLastError () returned 0x0 [0058.908] GetExitCodeProcess (in: hProcess=0x9c8, lpExitCode=0x2665bdc | out: lpExitCode=0x2665bdc*=0x103) returned 1 [0058.909] GetLastError () returned 0x0 [0058.909] CheckRemoteDebuggerPresent (in: hProcess=0x9c8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.909] GetLastError () returned 0x0 [0058.909] GetCurrentProcessId () returned 0x13cc [0058.909] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9cc [0058.909] GetLastError () returned 0x0 [0058.909] GetExitCodeProcess (in: hProcess=0x9cc, lpExitCode=0x2665c90 | out: lpExitCode=0x2665c90*=0x103) returned 1 [0058.909] GetLastError () returned 0x0 [0058.909] CheckRemoteDebuggerPresent (in: hProcess=0x9cc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.909] GetLastError () returned 0x0 [0058.909] GetCurrentProcessId () returned 0x13cc [0058.909] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9d0 [0058.909] GetLastError () returned 0x0 [0058.909] GetExitCodeProcess (in: hProcess=0x9d0, lpExitCode=0x2665d44 | out: lpExitCode=0x2665d44*=0x103) returned 1 [0058.909] GetLastError () returned 0x0 [0058.909] CheckRemoteDebuggerPresent (in: hProcess=0x9d0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.909] GetLastError () returned 0x0 [0058.909] GetCurrentProcessId () returned 0x13cc [0058.910] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9d4 [0058.910] GetLastError () returned 0x0 [0058.910] GetExitCodeProcess (in: hProcess=0x9d4, lpExitCode=0x2665df8 | out: lpExitCode=0x2665df8*=0x103) returned 1 [0058.910] GetLastError () returned 0x0 [0058.910] CheckRemoteDebuggerPresent (in: hProcess=0x9d4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.910] GetLastError () returned 0x0 [0058.910] GetCurrentProcessId () returned 0x13cc [0058.910] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9d8 [0058.910] GetLastError () returned 0x0 [0058.910] GetExitCodeProcess (in: hProcess=0x9d8, lpExitCode=0x2665eac | out: lpExitCode=0x2665eac*=0x103) returned 1 [0058.910] GetLastError () returned 0x0 [0058.910] CheckRemoteDebuggerPresent (in: hProcess=0x9d8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.910] GetLastError () returned 0x0 [0058.910] GetCurrentProcessId () returned 0x13cc [0058.910] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9dc [0058.910] GetLastError () returned 0x0 [0058.910] GetExitCodeProcess (in: hProcess=0x9dc, lpExitCode=0x2665f60 | out: lpExitCode=0x2665f60*=0x103) returned 1 [0058.911] GetLastError () returned 0x0 [0058.911] CheckRemoteDebuggerPresent (in: hProcess=0x9dc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.911] GetLastError () returned 0x0 [0058.911] GetCurrentProcessId () returned 0x13cc [0058.911] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9e0 [0058.911] GetLastError () returned 0x0 [0058.911] GetExitCodeProcess (in: hProcess=0x9e0, lpExitCode=0x2666014 | out: lpExitCode=0x2666014*=0x103) returned 1 [0058.911] GetLastError () returned 0x0 [0058.911] CheckRemoteDebuggerPresent (in: hProcess=0x9e0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.911] GetLastError () returned 0x0 [0058.911] GetCurrentProcessId () returned 0x13cc [0058.911] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9e4 [0058.911] GetLastError () returned 0x0 [0058.911] GetExitCodeProcess (in: hProcess=0x9e4, lpExitCode=0x26660c8 | out: lpExitCode=0x26660c8*=0x103) returned 1 [0058.912] GetLastError () returned 0x0 [0058.912] CheckRemoteDebuggerPresent (in: hProcess=0x9e4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.912] GetLastError () returned 0x0 [0058.912] GetCurrentProcessId () returned 0x13cc [0058.912] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9e8 [0058.912] GetLastError () returned 0x0 [0058.912] GetExitCodeProcess (in: hProcess=0x9e8, lpExitCode=0x266617c | out: lpExitCode=0x266617c*=0x103) returned 1 [0058.912] GetLastError () returned 0x0 [0058.912] CheckRemoteDebuggerPresent (in: hProcess=0x9e8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.912] GetLastError () returned 0x0 [0058.912] GetCurrentProcessId () returned 0x13cc [0058.912] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9ec [0058.912] GetLastError () returned 0x0 [0058.912] GetExitCodeProcess (in: hProcess=0x9ec, lpExitCode=0x2666230 | out: lpExitCode=0x2666230*=0x103) returned 1 [0058.912] GetLastError () returned 0x0 [0058.912] CheckRemoteDebuggerPresent (in: hProcess=0x9ec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.912] GetLastError () returned 0x0 [0058.912] GetCurrentProcessId () returned 0x13cc [0058.913] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9f0 [0058.913] GetLastError () returned 0x0 [0058.913] GetExitCodeProcess (in: hProcess=0x9f0, lpExitCode=0x26662e4 | out: lpExitCode=0x26662e4*=0x103) returned 1 [0058.913] GetLastError () returned 0x0 [0058.913] CheckRemoteDebuggerPresent (in: hProcess=0x9f0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.913] GetLastError () returned 0x0 [0058.913] GetCurrentProcessId () returned 0x13cc [0058.913] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9f4 [0058.913] GetLastError () returned 0x0 [0058.913] GetExitCodeProcess (in: hProcess=0x9f4, lpExitCode=0x2666398 | out: lpExitCode=0x2666398*=0x103) returned 1 [0058.913] GetLastError () returned 0x0 [0058.913] CheckRemoteDebuggerPresent (in: hProcess=0x9f4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.913] GetLastError () returned 0x0 [0058.913] GetCurrentProcessId () returned 0x13cc [0058.913] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9f8 [0058.913] GetLastError () returned 0x0 [0058.913] GetExitCodeProcess (in: hProcess=0x9f8, lpExitCode=0x266644c | out: lpExitCode=0x266644c*=0x103) returned 1 [0058.914] GetLastError () returned 0x0 [0058.914] CheckRemoteDebuggerPresent (in: hProcess=0x9f8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.914] GetLastError () returned 0x0 [0058.914] GetCurrentProcessId () returned 0x13cc [0058.914] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0x9fc [0058.914] GetLastError () returned 0x0 [0058.914] GetExitCodeProcess (in: hProcess=0x9fc, lpExitCode=0x2666500 | out: lpExitCode=0x2666500*=0x103) returned 1 [0058.914] GetLastError () returned 0x0 [0058.914] CheckRemoteDebuggerPresent (in: hProcess=0x9fc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.914] GetLastError () returned 0x0 [0058.914] GetCurrentProcessId () returned 0x13cc [0058.914] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa00 [0058.914] GetLastError () returned 0x0 [0058.914] GetExitCodeProcess (in: hProcess=0xa00, lpExitCode=0x26665b4 | out: lpExitCode=0x26665b4*=0x103) returned 1 [0058.914] GetLastError () returned 0x0 [0058.914] CheckRemoteDebuggerPresent (in: hProcess=0xa00, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.914] GetLastError () returned 0x0 [0058.915] GetCurrentProcessId () returned 0x13cc [0058.915] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa04 [0058.915] GetLastError () returned 0x0 [0058.915] GetExitCodeProcess (in: hProcess=0xa04, lpExitCode=0x2666668 | out: lpExitCode=0x2666668*=0x103) returned 1 [0058.915] GetLastError () returned 0x0 [0058.915] CheckRemoteDebuggerPresent (in: hProcess=0xa04, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.915] GetLastError () returned 0x0 [0058.915] GetCurrentProcessId () returned 0x13cc [0058.915] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa08 [0058.915] GetLastError () returned 0x0 [0058.915] GetExitCodeProcess (in: hProcess=0xa08, lpExitCode=0x266671c | out: lpExitCode=0x266671c*=0x103) returned 1 [0058.915] GetLastError () returned 0x0 [0058.915] CheckRemoteDebuggerPresent (in: hProcess=0xa08, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.915] GetLastError () returned 0x0 [0058.915] GetCurrentProcessId () returned 0x13cc [0058.915] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa0c [0058.915] GetLastError () returned 0x0 [0058.915] GetExitCodeProcess (in: hProcess=0xa0c, lpExitCode=0x26667d0 | out: lpExitCode=0x26667d0*=0x103) returned 1 [0058.915] GetLastError () returned 0x0 [0058.916] CheckRemoteDebuggerPresent (in: hProcess=0xa0c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.916] GetLastError () returned 0x0 [0058.916] GetCurrentProcessId () returned 0x13cc [0058.916] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa10 [0058.916] GetLastError () returned 0x0 [0058.916] GetExitCodeProcess (in: hProcess=0xa10, lpExitCode=0x2666884 | out: lpExitCode=0x2666884*=0x103) returned 1 [0058.916] GetLastError () returned 0x0 [0058.916] CheckRemoteDebuggerPresent (in: hProcess=0xa10, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.916] GetLastError () returned 0x0 [0058.916] GetCurrentProcessId () returned 0x13cc [0058.916] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa14 [0058.916] GetLastError () returned 0x0 [0058.916] GetExitCodeProcess (in: hProcess=0xa14, lpExitCode=0x2666938 | out: lpExitCode=0x2666938*=0x103) returned 1 [0058.916] GetLastError () returned 0x0 [0058.916] CheckRemoteDebuggerPresent (in: hProcess=0xa14, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.916] GetLastError () returned 0x0 [0058.916] GetCurrentProcessId () returned 0x13cc [0058.916] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa18 [0058.916] GetLastError () returned 0x0 [0058.917] GetExitCodeProcess (in: hProcess=0xa18, lpExitCode=0x26669ec | out: lpExitCode=0x26669ec*=0x103) returned 1 [0058.917] GetLastError () returned 0x0 [0058.917] CheckRemoteDebuggerPresent (in: hProcess=0xa18, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.917] GetLastError () returned 0x0 [0058.917] GetCurrentProcessId () returned 0x13cc [0058.917] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa1c [0058.917] GetLastError () returned 0x0 [0058.917] GetExitCodeProcess (in: hProcess=0xa1c, lpExitCode=0x2666aa0 | out: lpExitCode=0x2666aa0*=0x103) returned 1 [0058.919] GetLastError () returned 0x0 [0058.919] CheckRemoteDebuggerPresent (in: hProcess=0xa1c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.919] GetLastError () returned 0x0 [0058.919] GetCurrentProcessId () returned 0x13cc [0058.919] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa20 [0058.919] GetLastError () returned 0x0 [0058.919] GetExitCodeProcess (in: hProcess=0xa20, lpExitCode=0x2666b54 | out: lpExitCode=0x2666b54*=0x103) returned 1 [0058.919] GetLastError () returned 0x0 [0058.919] CheckRemoteDebuggerPresent (in: hProcess=0xa20, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.919] GetLastError () returned 0x0 [0058.919] GetCurrentProcessId () returned 0x13cc [0058.919] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa24 [0058.919] GetLastError () returned 0x0 [0058.919] GetExitCodeProcess (in: hProcess=0xa24, lpExitCode=0x2666c08 | out: lpExitCode=0x2666c08*=0x103) returned 1 [0058.919] GetLastError () returned 0x0 [0058.919] CheckRemoteDebuggerPresent (in: hProcess=0xa24, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.919] GetLastError () returned 0x0 [0058.920] GetCurrentProcessId () returned 0x13cc [0058.920] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa28 [0058.920] GetLastError () returned 0x0 [0058.920] GetExitCodeProcess (in: hProcess=0xa28, lpExitCode=0x2666cbc | out: lpExitCode=0x2666cbc*=0x103) returned 1 [0058.920] GetLastError () returned 0x0 [0058.920] CheckRemoteDebuggerPresent (in: hProcess=0xa28, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.920] GetLastError () returned 0x0 [0058.920] GetCurrentProcessId () returned 0x13cc [0058.920] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa2c [0058.920] GetLastError () returned 0x0 [0058.920] GetExitCodeProcess (in: hProcess=0xa2c, lpExitCode=0x2666d70 | out: lpExitCode=0x2666d70*=0x103) returned 1 [0058.920] GetLastError () returned 0x0 [0058.920] CheckRemoteDebuggerPresent (in: hProcess=0xa2c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.920] GetLastError () returned 0x0 [0058.920] GetCurrentProcessId () returned 0x13cc [0058.920] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa30 [0058.920] GetLastError () returned 0x0 [0058.920] GetExitCodeProcess (in: hProcess=0xa30, lpExitCode=0x2666e24 | out: lpExitCode=0x2666e24*=0x103) returned 1 [0058.921] GetLastError () returned 0x0 [0058.921] CheckRemoteDebuggerPresent (in: hProcess=0xa30, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.921] GetLastError () returned 0x0 [0058.921] GetCurrentProcessId () returned 0x13cc [0058.921] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa34 [0058.921] GetLastError () returned 0x0 [0058.921] GetExitCodeProcess (in: hProcess=0xa34, lpExitCode=0x2666ed8 | out: lpExitCode=0x2666ed8*=0x103) returned 1 [0058.921] GetLastError () returned 0x0 [0058.921] CheckRemoteDebuggerPresent (in: hProcess=0xa34, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.921] GetLastError () returned 0x0 [0058.921] GetCurrentProcessId () returned 0x13cc [0058.921] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa38 [0058.921] GetLastError () returned 0x0 [0058.921] GetExitCodeProcess (in: hProcess=0xa38, lpExitCode=0x2666f8c | out: lpExitCode=0x2666f8c*=0x103) returned 1 [0058.921] GetLastError () returned 0x0 [0058.921] CheckRemoteDebuggerPresent (in: hProcess=0xa38, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.921] GetLastError () returned 0x0 [0058.921] GetCurrentProcessId () returned 0x13cc [0058.922] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa3c [0058.922] GetLastError () returned 0x0 [0058.922] GetExitCodeProcess (in: hProcess=0xa3c, lpExitCode=0x2667040 | out: lpExitCode=0x2667040*=0x103) returned 1 [0058.922] GetLastError () returned 0x0 [0058.922] CheckRemoteDebuggerPresent (in: hProcess=0xa3c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.922] GetLastError () returned 0x0 [0058.922] GetCurrentProcessId () returned 0x13cc [0058.922] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa40 [0058.922] GetLastError () returned 0x0 [0058.922] GetExitCodeProcess (in: hProcess=0xa40, lpExitCode=0x26670f4 | out: lpExitCode=0x26670f4*=0x103) returned 1 [0058.922] GetLastError () returned 0x0 [0058.922] CheckRemoteDebuggerPresent (in: hProcess=0xa40, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.922] GetLastError () returned 0x0 [0058.922] GetCurrentProcessId () returned 0x13cc [0058.922] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa44 [0058.922] GetLastError () returned 0x0 [0058.922] GetExitCodeProcess (in: hProcess=0xa44, lpExitCode=0x26671a8 | out: lpExitCode=0x26671a8*=0x103) returned 1 [0058.922] GetLastError () returned 0x0 [0058.922] CheckRemoteDebuggerPresent (in: hProcess=0xa44, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.922] GetLastError () returned 0x0 [0058.923] GetCurrentProcessId () returned 0x13cc [0058.923] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa48 [0058.923] GetLastError () returned 0x0 [0058.923] GetExitCodeProcess (in: hProcess=0xa48, lpExitCode=0x266725c | out: lpExitCode=0x266725c*=0x103) returned 1 [0058.923] GetLastError () returned 0x0 [0058.923] CheckRemoteDebuggerPresent (in: hProcess=0xa48, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.923] GetLastError () returned 0x0 [0058.923] GetCurrentProcessId () returned 0x13cc [0058.923] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa4c [0058.923] GetLastError () returned 0x0 [0058.923] GetExitCodeProcess (in: hProcess=0xa4c, lpExitCode=0x2667310 | out: lpExitCode=0x2667310*=0x103) returned 1 [0058.923] GetLastError () returned 0x0 [0058.923] CheckRemoteDebuggerPresent (in: hProcess=0xa4c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.923] GetLastError () returned 0x0 [0058.923] GetCurrentProcessId () returned 0x13cc [0058.923] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa50 [0058.923] GetLastError () returned 0x0 [0058.923] GetExitCodeProcess (in: hProcess=0xa50, lpExitCode=0x26673c4 | out: lpExitCode=0x26673c4*=0x103) returned 1 [0058.924] GetLastError () returned 0x0 [0058.924] CheckRemoteDebuggerPresent (in: hProcess=0xa50, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.924] GetLastError () returned 0x0 [0058.924] GetCurrentProcessId () returned 0x13cc [0058.924] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa54 [0058.924] GetLastError () returned 0x0 [0058.924] GetExitCodeProcess (in: hProcess=0xa54, lpExitCode=0x2667478 | out: lpExitCode=0x2667478*=0x103) returned 1 [0058.924] GetLastError () returned 0x0 [0058.924] CheckRemoteDebuggerPresent (in: hProcess=0xa54, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.924] GetLastError () returned 0x0 [0058.924] GetCurrentProcessId () returned 0x13cc [0058.924] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa58 [0058.924] GetLastError () returned 0x0 [0058.924] GetExitCodeProcess (in: hProcess=0xa58, lpExitCode=0x266752c | out: lpExitCode=0x266752c*=0x103) returned 1 [0058.924] GetLastError () returned 0x0 [0058.924] CheckRemoteDebuggerPresent (in: hProcess=0xa58, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.924] GetLastError () returned 0x0 [0058.924] GetCurrentProcessId () returned 0x13cc [0058.925] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa5c [0058.925] GetLastError () returned 0x0 [0058.925] GetExitCodeProcess (in: hProcess=0xa5c, lpExitCode=0x26675e0 | out: lpExitCode=0x26675e0*=0x103) returned 1 [0058.925] GetLastError () returned 0x0 [0058.925] CheckRemoteDebuggerPresent (in: hProcess=0xa5c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.925] GetLastError () returned 0x0 [0058.925] GetCurrentProcessId () returned 0x13cc [0058.925] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa60 [0058.925] GetLastError () returned 0x0 [0058.925] GetExitCodeProcess (in: hProcess=0xa60, lpExitCode=0x2667694 | out: lpExitCode=0x2667694*=0x103) returned 1 [0058.925] GetLastError () returned 0x0 [0058.925] CheckRemoteDebuggerPresent (in: hProcess=0xa60, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.925] GetLastError () returned 0x0 [0058.925] GetCurrentProcessId () returned 0x13cc [0058.925] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa64 [0058.925] GetLastError () returned 0x0 [0058.925] GetExitCodeProcess (in: hProcess=0xa64, lpExitCode=0x2667748 | out: lpExitCode=0x2667748*=0x103) returned 1 [0058.925] GetLastError () returned 0x0 [0058.925] CheckRemoteDebuggerPresent (in: hProcess=0xa64, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.926] GetLastError () returned 0x0 [0058.926] GetCurrentProcessId () returned 0x13cc [0058.926] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa68 [0058.926] GetLastError () returned 0x0 [0058.926] GetExitCodeProcess (in: hProcess=0xa68, lpExitCode=0x26677fc | out: lpExitCode=0x26677fc*=0x103) returned 1 [0058.926] GetLastError () returned 0x0 [0058.926] CheckRemoteDebuggerPresent (in: hProcess=0xa68, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.926] GetLastError () returned 0x0 [0058.926] GetCurrentProcessId () returned 0x13cc [0058.926] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa6c [0058.926] GetLastError () returned 0x0 [0058.926] GetExitCodeProcess (in: hProcess=0xa6c, lpExitCode=0x26678b0 | out: lpExitCode=0x26678b0*=0x103) returned 1 [0058.926] GetLastError () returned 0x0 [0058.926] CheckRemoteDebuggerPresent (in: hProcess=0xa6c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.926] GetLastError () returned 0x0 [0058.926] GetCurrentProcessId () returned 0x13cc [0058.926] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa70 [0058.927] GetLastError () returned 0x0 [0058.927] GetExitCodeProcess (in: hProcess=0xa70, lpExitCode=0x2667964 | out: lpExitCode=0x2667964*=0x103) returned 1 [0058.927] GetLastError () returned 0x0 [0058.927] CheckRemoteDebuggerPresent (in: hProcess=0xa70, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.927] GetLastError () returned 0x0 [0058.927] GetCurrentProcessId () returned 0x13cc [0058.927] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa74 [0058.927] GetLastError () returned 0x0 [0058.927] GetExitCodeProcess (in: hProcess=0xa74, lpExitCode=0x2667a18 | out: lpExitCode=0x2667a18*=0x103) returned 1 [0058.927] GetLastError () returned 0x0 [0058.927] CheckRemoteDebuggerPresent (in: hProcess=0xa74, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.927] GetLastError () returned 0x0 [0058.927] GetCurrentProcessId () returned 0x13cc [0058.927] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa78 [0058.927] GetLastError () returned 0x0 [0058.927] GetExitCodeProcess (in: hProcess=0xa78, lpExitCode=0x2667acc | out: lpExitCode=0x2667acc*=0x103) returned 1 [0058.927] GetLastError () returned 0x0 [0058.927] CheckRemoteDebuggerPresent (in: hProcess=0xa78, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.928] GetLastError () returned 0x0 [0058.928] GetCurrentProcessId () returned 0x13cc [0058.928] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa7c [0058.928] GetLastError () returned 0x0 [0058.928] GetExitCodeProcess (in: hProcess=0xa7c, lpExitCode=0x2667b80 | out: lpExitCode=0x2667b80*=0x103) returned 1 [0058.928] GetLastError () returned 0x0 [0058.928] CheckRemoteDebuggerPresent (in: hProcess=0xa7c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.928] GetLastError () returned 0x0 [0058.928] GetCurrentProcessId () returned 0x13cc [0058.928] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa80 [0058.928] GetLastError () returned 0x0 [0058.928] GetExitCodeProcess (in: hProcess=0xa80, lpExitCode=0x2667c34 | out: lpExitCode=0x2667c34*=0x103) returned 1 [0058.928] GetLastError () returned 0x0 [0058.928] CheckRemoteDebuggerPresent (in: hProcess=0xa80, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.928] GetLastError () returned 0x0 [0058.928] GetCurrentProcessId () returned 0x13cc [0058.928] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa84 [0058.929] GetLastError () returned 0x0 [0058.929] GetExitCodeProcess (in: hProcess=0xa84, lpExitCode=0x2667ce8 | out: lpExitCode=0x2667ce8*=0x103) returned 1 [0058.929] GetLastError () returned 0x0 [0058.929] CheckRemoteDebuggerPresent (in: hProcess=0xa84, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.929] GetLastError () returned 0x0 [0058.929] GetCurrentProcessId () returned 0x13cc [0058.929] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa88 [0058.929] GetLastError () returned 0x0 [0058.929] GetExitCodeProcess (in: hProcess=0xa88, lpExitCode=0x2667d9c | out: lpExitCode=0x2667d9c*=0x103) returned 1 [0058.929] GetLastError () returned 0x0 [0058.929] CheckRemoteDebuggerPresent (in: hProcess=0xa88, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.929] GetLastError () returned 0x0 [0058.929] GetCurrentProcessId () returned 0x13cc [0058.929] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa8c [0058.929] GetLastError () returned 0x0 [0058.929] GetExitCodeProcess (in: hProcess=0xa8c, lpExitCode=0x2667e50 | out: lpExitCode=0x2667e50*=0x103) returned 1 [0058.930] GetLastError () returned 0x0 [0058.930] CheckRemoteDebuggerPresent (in: hProcess=0xa8c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.930] GetLastError () returned 0x0 [0058.930] GetCurrentProcessId () returned 0x13cc [0058.930] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa90 [0058.930] GetLastError () returned 0x0 [0058.930] GetExitCodeProcess (in: hProcess=0xa90, lpExitCode=0x2667f04 | out: lpExitCode=0x2667f04*=0x103) returned 1 [0058.930] GetLastError () returned 0x0 [0058.930] CheckRemoteDebuggerPresent (in: hProcess=0xa90, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.930] GetLastError () returned 0x0 [0058.930] GetCurrentProcessId () returned 0x13cc [0058.930] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa94 [0058.930] GetLastError () returned 0x0 [0058.931] GetExitCodeProcess (in: hProcess=0xa94, lpExitCode=0x2667fb8 | out: lpExitCode=0x2667fb8*=0x103) returned 1 [0058.931] GetLastError () returned 0x0 [0058.931] CheckRemoteDebuggerPresent (in: hProcess=0xa94, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.931] GetLastError () returned 0x0 [0058.931] GetCurrentProcessId () returned 0x13cc [0058.931] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa98 [0058.931] GetLastError () returned 0x0 [0058.931] GetExitCodeProcess (in: hProcess=0xa98, lpExitCode=0x266806c | out: lpExitCode=0x266806c*=0x103) returned 1 [0058.931] GetLastError () returned 0x0 [0058.931] CheckRemoteDebuggerPresent (in: hProcess=0xa98, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.931] GetLastError () returned 0x0 [0058.931] GetCurrentProcessId () returned 0x13cc [0058.931] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xa9c [0058.931] GetLastError () returned 0x0 [0058.931] GetExitCodeProcess (in: hProcess=0xa9c, lpExitCode=0x2668120 | out: lpExitCode=0x2668120*=0x103) returned 1 [0058.931] GetLastError () returned 0x0 [0058.931] CheckRemoteDebuggerPresent (in: hProcess=0xa9c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.931] GetLastError () returned 0x0 [0058.932] GetCurrentProcessId () returned 0x13cc [0058.932] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaa0 [0058.932] GetLastError () returned 0x0 [0058.932] GetExitCodeProcess (in: hProcess=0xaa0, lpExitCode=0x26681d4 | out: lpExitCode=0x26681d4*=0x103) returned 1 [0058.932] GetLastError () returned 0x0 [0058.932] CheckRemoteDebuggerPresent (in: hProcess=0xaa0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.932] GetLastError () returned 0x0 [0058.932] GetCurrentProcessId () returned 0x13cc [0058.932] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaa4 [0058.932] GetLastError () returned 0x0 [0058.932] GetExitCodeProcess (in: hProcess=0xaa4, lpExitCode=0x2668288 | out: lpExitCode=0x2668288*=0x103) returned 1 [0058.932] GetLastError () returned 0x0 [0058.932] CheckRemoteDebuggerPresent (in: hProcess=0xaa4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.932] GetLastError () returned 0x0 [0058.932] GetCurrentProcessId () returned 0x13cc [0058.932] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaa8 [0058.932] GetLastError () returned 0x0 [0058.932] GetExitCodeProcess (in: hProcess=0xaa8, lpExitCode=0x266833c | out: lpExitCode=0x266833c*=0x103) returned 1 [0058.933] GetLastError () returned 0x0 [0058.933] CheckRemoteDebuggerPresent (in: hProcess=0xaa8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.933] GetLastError () returned 0x0 [0058.934] GetCurrentProcessId () returned 0x13cc [0058.934] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaac [0058.934] GetLastError () returned 0x0 [0058.934] GetExitCodeProcess (in: hProcess=0xaac, lpExitCode=0x26683f0 | out: lpExitCode=0x26683f0*=0x103) returned 1 [0058.934] GetLastError () returned 0x0 [0058.934] CheckRemoteDebuggerPresent (in: hProcess=0xaac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.934] GetLastError () returned 0x0 [0058.934] GetCurrentProcessId () returned 0x13cc [0058.934] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xab0 [0058.934] GetLastError () returned 0x0 [0058.934] GetExitCodeProcess (in: hProcess=0xab0, lpExitCode=0x26684a4 | out: lpExitCode=0x26684a4*=0x103) returned 1 [0058.934] GetLastError () returned 0x0 [0058.934] CheckRemoteDebuggerPresent (in: hProcess=0xab0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.934] GetLastError () returned 0x0 [0058.935] GetCurrentProcessId () returned 0x13cc [0058.935] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xab4 [0058.935] GetLastError () returned 0x0 [0058.935] GetExitCodeProcess (in: hProcess=0xab4, lpExitCode=0x2668558 | out: lpExitCode=0x2668558*=0x103) returned 1 [0058.935] GetLastError () returned 0x0 [0058.935] CheckRemoteDebuggerPresent (in: hProcess=0xab4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.935] GetLastError () returned 0x0 [0058.935] GetCurrentProcessId () returned 0x13cc [0058.935] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xab8 [0058.935] GetLastError () returned 0x0 [0058.935] GetExitCodeProcess (in: hProcess=0xab8, lpExitCode=0x266860c | out: lpExitCode=0x266860c*=0x103) returned 1 [0058.935] GetLastError () returned 0x0 [0058.935] CheckRemoteDebuggerPresent (in: hProcess=0xab8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.935] GetLastError () returned 0x0 [0058.936] GetCurrentProcessId () returned 0x13cc [0058.936] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xabc [0058.936] GetLastError () returned 0x0 [0058.936] GetExitCodeProcess (in: hProcess=0xabc, lpExitCode=0x26686c0 | out: lpExitCode=0x26686c0*=0x103) returned 1 [0058.936] GetLastError () returned 0x0 [0058.936] CheckRemoteDebuggerPresent (in: hProcess=0xabc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.936] GetLastError () returned 0x0 [0058.936] GetCurrentProcessId () returned 0x13cc [0058.936] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xac0 [0058.936] GetLastError () returned 0x0 [0058.936] GetExitCodeProcess (in: hProcess=0xac0, lpExitCode=0x2668774 | out: lpExitCode=0x2668774*=0x103) returned 1 [0058.936] GetLastError () returned 0x0 [0058.936] CheckRemoteDebuggerPresent (in: hProcess=0xac0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.936] GetLastError () returned 0x0 [0058.937] GetCurrentProcessId () returned 0x13cc [0058.937] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xac4 [0058.937] GetLastError () returned 0x0 [0058.937] GetExitCodeProcess (in: hProcess=0xac4, lpExitCode=0x2668828 | out: lpExitCode=0x2668828*=0x103) returned 1 [0058.937] GetLastError () returned 0x0 [0058.937] CheckRemoteDebuggerPresent (in: hProcess=0xac4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.937] GetLastError () returned 0x0 [0058.937] GetCurrentProcessId () returned 0x13cc [0058.937] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xac8 [0058.937] GetLastError () returned 0x0 [0058.937] GetExitCodeProcess (in: hProcess=0xac8, lpExitCode=0x26688dc | out: lpExitCode=0x26688dc*=0x103) returned 1 [0058.938] GetLastError () returned 0x0 [0058.938] CheckRemoteDebuggerPresent (in: hProcess=0xac8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.938] GetLastError () returned 0x0 [0058.938] GetCurrentProcessId () returned 0x13cc [0058.938] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xacc [0058.938] GetLastError () returned 0x0 [0058.938] GetExitCodeProcess (in: hProcess=0xacc, lpExitCode=0x2668990 | out: lpExitCode=0x2668990*=0x103) returned 1 [0058.938] GetLastError () returned 0x0 [0058.938] CheckRemoteDebuggerPresent (in: hProcess=0xacc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.938] GetLastError () returned 0x0 [0058.938] GetCurrentProcessId () returned 0x13cc [0058.938] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xad0 [0058.938] GetLastError () returned 0x0 [0058.938] GetExitCodeProcess (in: hProcess=0xad0, lpExitCode=0x2668a44 | out: lpExitCode=0x2668a44*=0x103) returned 1 [0058.939] GetLastError () returned 0x0 [0058.939] CheckRemoteDebuggerPresent (in: hProcess=0xad0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.939] GetLastError () returned 0x0 [0058.939] GetCurrentProcessId () returned 0x13cc [0058.939] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xad4 [0058.939] GetLastError () returned 0x0 [0058.939] GetExitCodeProcess (in: hProcess=0xad4, lpExitCode=0x2668af8 | out: lpExitCode=0x2668af8*=0x103) returned 1 [0058.939] GetLastError () returned 0x0 [0058.939] CheckRemoteDebuggerPresent (in: hProcess=0xad4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.939] GetLastError () returned 0x0 [0058.939] GetCurrentProcessId () returned 0x13cc [0058.939] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xad8 [0058.939] GetLastError () returned 0x0 [0058.939] GetExitCodeProcess (in: hProcess=0xad8, lpExitCode=0x2668bac | out: lpExitCode=0x2668bac*=0x103) returned 1 [0058.940] GetLastError () returned 0x0 [0058.940] CheckRemoteDebuggerPresent (in: hProcess=0xad8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.940] GetLastError () returned 0x0 [0058.940] GetCurrentProcessId () returned 0x13cc [0058.940] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xadc [0058.940] GetLastError () returned 0x0 [0058.940] GetExitCodeProcess (in: hProcess=0xadc, lpExitCode=0x2668c60 | out: lpExitCode=0x2668c60*=0x103) returned 1 [0058.940] GetLastError () returned 0x0 [0058.940] CheckRemoteDebuggerPresent (in: hProcess=0xadc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.940] GetLastError () returned 0x0 [0058.940] GetCurrentProcessId () returned 0x13cc [0058.940] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xae0 [0058.940] GetLastError () returned 0x0 [0058.940] GetExitCodeProcess (in: hProcess=0xae0, lpExitCode=0x2668d14 | out: lpExitCode=0x2668d14*=0x103) returned 1 [0058.941] GetLastError () returned 0x0 [0058.941] CheckRemoteDebuggerPresent (in: hProcess=0xae0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.941] GetLastError () returned 0x0 [0058.941] GetCurrentProcessId () returned 0x13cc [0058.941] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xae4 [0058.941] GetLastError () returned 0x0 [0058.941] GetExitCodeProcess (in: hProcess=0xae4, lpExitCode=0x2668dc8 | out: lpExitCode=0x2668dc8*=0x103) returned 1 [0058.941] GetLastError () returned 0x0 [0058.941] CheckRemoteDebuggerPresent (in: hProcess=0xae4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.941] GetLastError () returned 0x0 [0058.941] GetCurrentProcessId () returned 0x13cc [0058.941] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xae8 [0058.941] GetLastError () returned 0x0 [0058.941] GetExitCodeProcess (in: hProcess=0xae8, lpExitCode=0x2668e7c | out: lpExitCode=0x2668e7c*=0x103) returned 1 [0058.942] GetLastError () returned 0x0 [0058.942] CheckRemoteDebuggerPresent (in: hProcess=0xae8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.942] GetLastError () returned 0x0 [0058.942] GetCurrentProcessId () returned 0x13cc [0058.942] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaec [0058.942] GetLastError () returned 0x0 [0058.942] GetExitCodeProcess (in: hProcess=0xaec, lpExitCode=0x2668f30 | out: lpExitCode=0x2668f30*=0x103) returned 1 [0058.942] GetLastError () returned 0x0 [0058.942] CheckRemoteDebuggerPresent (in: hProcess=0xaec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.942] GetLastError () returned 0x0 [0058.942] GetCurrentProcessId () returned 0x13cc [0058.942] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaf0 [0058.943] GetLastError () returned 0x0 [0058.943] GetExitCodeProcess (in: hProcess=0xaf0, lpExitCode=0x2668fe4 | out: lpExitCode=0x2668fe4*=0x103) returned 1 [0058.943] GetLastError () returned 0x0 [0058.943] CheckRemoteDebuggerPresent (in: hProcess=0xaf0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.943] GetLastError () returned 0x0 [0058.943] GetCurrentProcessId () returned 0x13cc [0058.943] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaf4 [0058.943] GetLastError () returned 0x0 [0058.943] GetExitCodeProcess (in: hProcess=0xaf4, lpExitCode=0x2669098 | out: lpExitCode=0x2669098*=0x103) returned 1 [0058.943] GetLastError () returned 0x0 [0058.943] CheckRemoteDebuggerPresent (in: hProcess=0xaf4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.943] GetLastError () returned 0x0 [0058.943] GetCurrentProcessId () returned 0x13cc [0058.944] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xaf8 [0058.944] GetLastError () returned 0x0 [0058.944] GetExitCodeProcess (in: hProcess=0xaf8, lpExitCode=0x266914c | out: lpExitCode=0x266914c*=0x103) returned 1 [0058.944] GetLastError () returned 0x0 [0058.944] CheckRemoteDebuggerPresent (in: hProcess=0xaf8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.944] GetLastError () returned 0x0 [0058.944] GetCurrentProcessId () returned 0x13cc [0058.944] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xafc [0058.944] GetLastError () returned 0x0 [0058.944] GetExitCodeProcess (in: hProcess=0xafc, lpExitCode=0x2669200 | out: lpExitCode=0x2669200*=0x103) returned 1 [0058.944] GetLastError () returned 0x0 [0058.944] CheckRemoteDebuggerPresent (in: hProcess=0xafc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.944] GetLastError () returned 0x0 [0058.944] GetCurrentProcessId () returned 0x13cc [0058.944] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb00 [0058.944] GetLastError () returned 0x0 [0058.945] GetExitCodeProcess (in: hProcess=0xb00, lpExitCode=0x26692b4 | out: lpExitCode=0x26692b4*=0x103) returned 1 [0058.945] GetLastError () returned 0x0 [0058.945] CheckRemoteDebuggerPresent (in: hProcess=0xb00, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.945] GetLastError () returned 0x0 [0058.945] GetCurrentProcessId () returned 0x13cc [0058.945] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb04 [0058.945] GetLastError () returned 0x0 [0058.945] GetExitCodeProcess (in: hProcess=0xb04, lpExitCode=0x2669368 | out: lpExitCode=0x2669368*=0x103) returned 1 [0058.945] GetLastError () returned 0x0 [0058.945] CheckRemoteDebuggerPresent (in: hProcess=0xb04, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.945] GetLastError () returned 0x0 [0058.945] GetCurrentProcessId () returned 0x13cc [0058.945] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb08 [0058.945] GetLastError () returned 0x0 [0058.946] GetExitCodeProcess (in: hProcess=0xb08, lpExitCode=0x266941c | out: lpExitCode=0x266941c*=0x103) returned 1 [0058.946] GetLastError () returned 0x0 [0058.946] CheckRemoteDebuggerPresent (in: hProcess=0xb08, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.946] GetLastError () returned 0x0 [0058.946] GetCurrentProcessId () returned 0x13cc [0058.946] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb0c [0058.946] GetLastError () returned 0x0 [0058.946] GetExitCodeProcess (in: hProcess=0xb0c, lpExitCode=0x26694d0 | out: lpExitCode=0x26694d0*=0x103) returned 1 [0058.946] GetLastError () returned 0x0 [0058.946] CheckRemoteDebuggerPresent (in: hProcess=0xb0c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.946] GetLastError () returned 0x0 [0058.946] GetCurrentProcessId () returned 0x13cc [0058.947] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb10 [0058.947] GetLastError () returned 0x0 [0058.947] GetExitCodeProcess (in: hProcess=0xb10, lpExitCode=0x2669584 | out: lpExitCode=0x2669584*=0x103) returned 1 [0058.947] GetLastError () returned 0x0 [0058.947] CheckRemoteDebuggerPresent (in: hProcess=0xb10, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.947] GetLastError () returned 0x0 [0058.947] GetCurrentProcessId () returned 0x13cc [0058.947] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb14 [0058.947] GetLastError () returned 0x0 [0058.947] GetExitCodeProcess (in: hProcess=0xb14, lpExitCode=0x2669638 | out: lpExitCode=0x2669638*=0x103) returned 1 [0058.947] GetLastError () returned 0x0 [0058.947] CheckRemoteDebuggerPresent (in: hProcess=0xb14, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.947] GetLastError () returned 0x0 [0058.947] GetCurrentProcessId () returned 0x13cc [0058.947] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb18 [0058.948] GetLastError () returned 0x0 [0058.948] GetExitCodeProcess (in: hProcess=0xb18, lpExitCode=0x26696ec | out: lpExitCode=0x26696ec*=0x103) returned 1 [0058.948] GetLastError () returned 0x0 [0058.948] CheckRemoteDebuggerPresent (in: hProcess=0xb18, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.948] GetLastError () returned 0x0 [0058.948] GetCurrentProcessId () returned 0x13cc [0058.948] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb1c [0058.948] GetLastError () returned 0x0 [0058.948] GetExitCodeProcess (in: hProcess=0xb1c, lpExitCode=0x26697a0 | out: lpExitCode=0x26697a0*=0x103) returned 1 [0058.948] GetLastError () returned 0x0 [0058.948] CheckRemoteDebuggerPresent (in: hProcess=0xb1c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.948] GetLastError () returned 0x0 [0058.948] GetCurrentProcessId () returned 0x13cc [0058.949] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb20 [0058.949] GetLastError () returned 0x0 [0058.949] GetExitCodeProcess (in: hProcess=0xb20, lpExitCode=0x2669854 | out: lpExitCode=0x2669854*=0x103) returned 1 [0058.949] GetLastError () returned 0x0 [0058.949] CheckRemoteDebuggerPresent (in: hProcess=0xb20, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.949] GetLastError () returned 0x0 [0058.949] GetCurrentProcessId () returned 0x13cc [0058.949] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb24 [0058.949] GetLastError () returned 0x0 [0058.949] GetExitCodeProcess (in: hProcess=0xb24, lpExitCode=0x2669908 | out: lpExitCode=0x2669908*=0x103) returned 1 [0058.949] GetLastError () returned 0x0 [0058.949] CheckRemoteDebuggerPresent (in: hProcess=0xb24, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.949] GetLastError () returned 0x0 [0058.949] GetCurrentProcessId () returned 0x13cc [0058.949] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb28 [0058.949] GetLastError () returned 0x0 [0058.950] GetExitCodeProcess (in: hProcess=0xb28, lpExitCode=0x26699bc | out: lpExitCode=0x26699bc*=0x103) returned 1 [0058.950] GetLastError () returned 0x0 [0058.950] CheckRemoteDebuggerPresent (in: hProcess=0xb28, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.950] GetLastError () returned 0x0 [0058.950] GetCurrentProcessId () returned 0x13cc [0058.950] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb2c [0058.950] GetLastError () returned 0x0 [0058.950] GetExitCodeProcess (in: hProcess=0xb2c, lpExitCode=0x2669a70 | out: lpExitCode=0x2669a70*=0x103) returned 1 [0058.950] GetLastError () returned 0x0 [0058.950] CheckRemoteDebuggerPresent (in: hProcess=0xb2c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.950] GetLastError () returned 0x0 [0058.950] GetCurrentProcessId () returned 0x13cc [0058.950] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb30 [0058.950] GetLastError () returned 0x0 [0058.950] GetExitCodeProcess (in: hProcess=0xb30, lpExitCode=0x2669b24 | out: lpExitCode=0x2669b24*=0x103) returned 1 [0058.950] GetLastError () returned 0x0 [0058.951] CheckRemoteDebuggerPresent (in: hProcess=0xb30, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.951] GetLastError () returned 0x0 [0058.951] GetCurrentProcessId () returned 0x13cc [0058.951] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb34 [0058.951] GetLastError () returned 0x0 [0058.951] GetExitCodeProcess (in: hProcess=0xb34, lpExitCode=0x2669bd8 | out: lpExitCode=0x2669bd8*=0x103) returned 1 [0058.951] GetLastError () returned 0x0 [0058.951] CheckRemoteDebuggerPresent (in: hProcess=0xb34, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.951] GetLastError () returned 0x0 [0058.951] GetCurrentProcessId () returned 0x13cc [0058.951] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb38 [0058.951] GetLastError () returned 0x0 [0058.951] GetExitCodeProcess (in: hProcess=0xb38, lpExitCode=0x2669c8c | out: lpExitCode=0x2669c8c*=0x103) returned 1 [0058.951] GetLastError () returned 0x0 [0058.951] CheckRemoteDebuggerPresent (in: hProcess=0xb38, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.951] GetLastError () returned 0x0 [0058.951] GetCurrentProcessId () returned 0x13cc [0058.951] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb3c [0058.951] GetLastError () returned 0x0 [0058.952] GetExitCodeProcess (in: hProcess=0xb3c, lpExitCode=0x2669d40 | out: lpExitCode=0x2669d40*=0x103) returned 1 [0058.952] GetLastError () returned 0x0 [0058.952] CheckRemoteDebuggerPresent (in: hProcess=0xb3c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.952] GetLastError () returned 0x0 [0058.952] GetCurrentProcessId () returned 0x13cc [0058.952] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb40 [0058.952] GetLastError () returned 0x0 [0058.952] GetExitCodeProcess (in: hProcess=0xb40, lpExitCode=0x2669df4 | out: lpExitCode=0x2669df4*=0x103) returned 1 [0058.952] GetLastError () returned 0x0 [0058.952] CheckRemoteDebuggerPresent (in: hProcess=0xb40, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.952] GetLastError () returned 0x0 [0058.952] GetCurrentProcessId () returned 0x13cc [0058.952] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb44 [0058.952] GetLastError () returned 0x0 [0058.952] GetExitCodeProcess (in: hProcess=0xb44, lpExitCode=0x2669ea8 | out: lpExitCode=0x2669ea8*=0x103) returned 1 [0058.952] GetLastError () returned 0x0 [0058.952] CheckRemoteDebuggerPresent (in: hProcess=0xb44, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.952] GetLastError () returned 0x0 [0058.952] GetCurrentProcessId () returned 0x13cc [0058.953] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb48 [0058.953] GetLastError () returned 0x0 [0058.953] GetExitCodeProcess (in: hProcess=0xb48, lpExitCode=0x2669f5c | out: lpExitCode=0x2669f5c*=0x103) returned 1 [0058.953] GetLastError () returned 0x0 [0058.953] CheckRemoteDebuggerPresent (in: hProcess=0xb48, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.953] GetLastError () returned 0x0 [0058.953] GetCurrentProcessId () returned 0x13cc [0058.953] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb4c [0058.953] GetLastError () returned 0x0 [0058.953] GetExitCodeProcess (in: hProcess=0xb4c, lpExitCode=0x266a010 | out: lpExitCode=0x266a010*=0x103) returned 1 [0058.953] GetLastError () returned 0x0 [0058.953] CheckRemoteDebuggerPresent (in: hProcess=0xb4c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.953] GetLastError () returned 0x0 [0058.953] GetCurrentProcessId () returned 0x13cc [0058.953] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb50 [0058.953] GetLastError () returned 0x0 [0058.954] GetExitCodeProcess (in: hProcess=0xb50, lpExitCode=0x266a0c4 | out: lpExitCode=0x266a0c4*=0x103) returned 1 [0058.954] GetLastError () returned 0x0 [0058.954] CheckRemoteDebuggerPresent (in: hProcess=0xb50, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.954] GetLastError () returned 0x0 [0058.954] GetCurrentProcessId () returned 0x13cc [0058.954] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb54 [0058.954] GetLastError () returned 0x0 [0058.954] GetExitCodeProcess (in: hProcess=0xb54, lpExitCode=0x266a178 | out: lpExitCode=0x266a178*=0x103) returned 1 [0058.954] GetLastError () returned 0x0 [0058.954] CheckRemoteDebuggerPresent (in: hProcess=0xb54, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.954] GetLastError () returned 0x0 [0058.954] GetCurrentProcessId () returned 0x13cc [0058.955] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb58 [0058.955] GetLastError () returned 0x0 [0058.955] GetExitCodeProcess (in: hProcess=0xb58, lpExitCode=0x266a22c | out: lpExitCode=0x266a22c*=0x103) returned 1 [0058.955] GetLastError () returned 0x0 [0058.955] CheckRemoteDebuggerPresent (in: hProcess=0xb58, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.955] GetLastError () returned 0x0 [0058.955] GetCurrentProcessId () returned 0x13cc [0058.955] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb5c [0058.956] GetLastError () returned 0x0 [0058.956] GetExitCodeProcess (in: hProcess=0xb5c, lpExitCode=0x266a2e0 | out: lpExitCode=0x266a2e0*=0x103) returned 1 [0058.956] GetLastError () returned 0x0 [0058.956] CheckRemoteDebuggerPresent (in: hProcess=0xb5c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.956] GetLastError () returned 0x0 [0058.956] GetCurrentProcessId () returned 0x13cc [0058.956] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb60 [0058.956] GetLastError () returned 0x0 [0058.956] GetExitCodeProcess (in: hProcess=0xb60, lpExitCode=0x266a394 | out: lpExitCode=0x266a394*=0x103) returned 1 [0058.956] GetLastError () returned 0x0 [0058.956] CheckRemoteDebuggerPresent (in: hProcess=0xb60, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.956] GetLastError () returned 0x0 [0058.956] GetCurrentProcessId () returned 0x13cc [0058.956] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb64 [0058.956] GetLastError () returned 0x0 [0058.956] GetExitCodeProcess (in: hProcess=0xb64, lpExitCode=0x266a448 | out: lpExitCode=0x266a448*=0x103) returned 1 [0058.956] GetLastError () returned 0x0 [0058.956] CheckRemoteDebuggerPresent (in: hProcess=0xb64, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.956] GetLastError () returned 0x0 [0058.957] GetCurrentProcessId () returned 0x13cc [0058.957] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb68 [0058.957] GetLastError () returned 0x0 [0058.957] GetExitCodeProcess (in: hProcess=0xb68, lpExitCode=0x266a4fc | out: lpExitCode=0x266a4fc*=0x103) returned 1 [0058.957] GetLastError () returned 0x0 [0058.957] CheckRemoteDebuggerPresent (in: hProcess=0xb68, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.957] GetLastError () returned 0x0 [0058.957] GetCurrentProcessId () returned 0x13cc [0058.957] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb6c [0058.957] GetLastError () returned 0x0 [0058.957] GetExitCodeProcess (in: hProcess=0xb6c, lpExitCode=0x266a5b0 | out: lpExitCode=0x266a5b0*=0x103) returned 1 [0058.957] GetLastError () returned 0x0 [0058.957] CheckRemoteDebuggerPresent (in: hProcess=0xb6c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.957] GetLastError () returned 0x0 [0058.957] GetCurrentProcessId () returned 0x13cc [0058.957] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb70 [0058.957] GetLastError () returned 0x0 [0058.957] GetExitCodeProcess (in: hProcess=0xb70, lpExitCode=0x266a664 | out: lpExitCode=0x266a664*=0x103) returned 1 [0058.957] GetLastError () returned 0x0 [0058.958] CheckRemoteDebuggerPresent (in: hProcess=0xb70, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.958] GetLastError () returned 0x0 [0058.958] GetCurrentProcessId () returned 0x13cc [0058.958] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb74 [0058.958] GetLastError () returned 0x0 [0058.958] GetExitCodeProcess (in: hProcess=0xb74, lpExitCode=0x266a718 | out: lpExitCode=0x266a718*=0x103) returned 1 [0058.958] GetLastError () returned 0x0 [0058.958] CheckRemoteDebuggerPresent (in: hProcess=0xb74, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.958] GetLastError () returned 0x0 [0058.958] GetCurrentProcessId () returned 0x13cc [0058.958] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb78 [0058.958] GetLastError () returned 0x0 [0058.958] GetExitCodeProcess (in: hProcess=0xb78, lpExitCode=0x266a7cc | out: lpExitCode=0x266a7cc*=0x103) returned 1 [0058.958] GetLastError () returned 0x0 [0058.958] CheckRemoteDebuggerPresent (in: hProcess=0xb78, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.958] GetLastError () returned 0x0 [0058.958] GetCurrentProcessId () returned 0x13cc [0058.959] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb7c [0058.959] GetLastError () returned 0x0 [0058.959] GetExitCodeProcess (in: hProcess=0xb7c, lpExitCode=0x266a880 | out: lpExitCode=0x266a880*=0x103) returned 1 [0058.959] GetLastError () returned 0x0 [0058.959] CheckRemoteDebuggerPresent (in: hProcess=0xb7c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.959] GetLastError () returned 0x0 [0058.959] GetCurrentProcessId () returned 0x13cc [0058.959] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb80 [0058.959] GetLastError () returned 0x0 [0058.959] GetExitCodeProcess (in: hProcess=0xb80, lpExitCode=0x266a934 | out: lpExitCode=0x266a934*=0x103) returned 1 [0058.959] GetLastError () returned 0x0 [0058.959] CheckRemoteDebuggerPresent (in: hProcess=0xb80, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.959] GetLastError () returned 0x0 [0058.959] GetCurrentProcessId () returned 0x13cc [0058.959] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb84 [0058.959] GetLastError () returned 0x0 [0058.959] GetExitCodeProcess (in: hProcess=0xb84, lpExitCode=0x266a9e8 | out: lpExitCode=0x266a9e8*=0x103) returned 1 [0058.959] GetLastError () returned 0x0 [0058.959] CheckRemoteDebuggerPresent (in: hProcess=0xb84, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.960] GetLastError () returned 0x0 [0058.960] GetCurrentProcessId () returned 0x13cc [0058.960] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb88 [0058.960] GetLastError () returned 0x0 [0058.960] GetExitCodeProcess (in: hProcess=0xb88, lpExitCode=0x266aa9c | out: lpExitCode=0x266aa9c*=0x103) returned 1 [0058.960] GetLastError () returned 0x0 [0058.960] CheckRemoteDebuggerPresent (in: hProcess=0xb88, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.960] GetLastError () returned 0x0 [0058.960] GetCurrentProcessId () returned 0x13cc [0058.960] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb8c [0058.960] GetLastError () returned 0x0 [0058.960] GetExitCodeProcess (in: hProcess=0xb8c, lpExitCode=0x266ab50 | out: lpExitCode=0x266ab50*=0x103) returned 1 [0058.960] GetLastError () returned 0x0 [0058.960] CheckRemoteDebuggerPresent (in: hProcess=0xb8c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.960] GetLastError () returned 0x0 [0058.960] GetCurrentProcessId () returned 0x13cc [0058.960] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb90 [0058.960] GetLastError () returned 0x0 [0058.960] GetExitCodeProcess (in: hProcess=0xb90, lpExitCode=0x266ac04 | out: lpExitCode=0x266ac04*=0x103) returned 1 [0058.961] GetLastError () returned 0x0 [0058.961] CheckRemoteDebuggerPresent (in: hProcess=0xb90, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.961] GetLastError () returned 0x0 [0058.961] GetCurrentProcessId () returned 0x13cc [0058.961] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb94 [0058.961] GetLastError () returned 0x0 [0058.961] GetExitCodeProcess (in: hProcess=0xb94, lpExitCode=0x266acb8 | out: lpExitCode=0x266acb8*=0x103) returned 1 [0058.961] GetLastError () returned 0x0 [0058.961] CheckRemoteDebuggerPresent (in: hProcess=0xb94, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.961] GetLastError () returned 0x0 [0058.961] GetCurrentProcessId () returned 0x13cc [0058.961] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb98 [0058.961] GetLastError () returned 0x0 [0058.961] GetExitCodeProcess (in: hProcess=0xb98, lpExitCode=0x266ad6c | out: lpExitCode=0x266ad6c*=0x103) returned 1 [0058.961] GetLastError () returned 0x0 [0058.961] CheckRemoteDebuggerPresent (in: hProcess=0xb98, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.961] GetLastError () returned 0x0 [0058.961] GetCurrentProcessId () returned 0x13cc [0058.962] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xb9c [0058.962] GetLastError () returned 0x0 [0058.962] GetExitCodeProcess (in: hProcess=0xb9c, lpExitCode=0x266ae20 | out: lpExitCode=0x266ae20*=0x103) returned 1 [0058.962] GetLastError () returned 0x0 [0058.962] CheckRemoteDebuggerPresent (in: hProcess=0xb9c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.962] GetLastError () returned 0x0 [0058.962] GetCurrentProcessId () returned 0x13cc [0058.962] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xba0 [0058.962] GetLastError () returned 0x0 [0058.962] GetExitCodeProcess (in: hProcess=0xba0, lpExitCode=0x266aed4 | out: lpExitCode=0x266aed4*=0x103) returned 1 [0058.962] GetLastError () returned 0x0 [0058.962] CheckRemoteDebuggerPresent (in: hProcess=0xba0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.962] GetLastError () returned 0x0 [0058.962] GetCurrentProcessId () returned 0x13cc [0058.962] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xba4 [0058.962] GetLastError () returned 0x0 [0058.962] GetExitCodeProcess (in: hProcess=0xba4, lpExitCode=0x266af88 | out: lpExitCode=0x266af88*=0x103) returned 1 [0058.963] GetLastError () returned 0x0 [0058.963] CheckRemoteDebuggerPresent (in: hProcess=0xba4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.963] GetLastError () returned 0x0 [0058.963] GetCurrentProcessId () returned 0x13cc [0058.963] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xba8 [0058.963] GetLastError () returned 0x0 [0058.963] GetExitCodeProcess (in: hProcess=0xba8, lpExitCode=0x266b03c | out: lpExitCode=0x266b03c*=0x103) returned 1 [0058.963] GetLastError () returned 0x0 [0058.963] CheckRemoteDebuggerPresent (in: hProcess=0xba8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.963] GetLastError () returned 0x0 [0058.963] GetCurrentProcessId () returned 0x13cc [0058.963] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbac [0058.963] GetLastError () returned 0x0 [0058.963] GetExitCodeProcess (in: hProcess=0xbac, lpExitCode=0x266b0f0 | out: lpExitCode=0x266b0f0*=0x103) returned 1 [0058.963] GetLastError () returned 0x0 [0058.963] CheckRemoteDebuggerPresent (in: hProcess=0xbac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.963] GetLastError () returned 0x0 [0058.964] GetCurrentProcessId () returned 0x13cc [0058.964] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbb0 [0058.964] GetLastError () returned 0x0 [0058.964] GetExitCodeProcess (in: hProcess=0xbb0, lpExitCode=0x266b1a4 | out: lpExitCode=0x266b1a4*=0x103) returned 1 [0058.964] GetLastError () returned 0x0 [0058.964] CheckRemoteDebuggerPresent (in: hProcess=0xbb0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.966] GetLastError () returned 0x0 [0058.967] GetCurrentProcessId () returned 0x13cc [0058.967] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbb4 [0058.967] GetLastError () returned 0x0 [0058.967] GetExitCodeProcess (in: hProcess=0xbb4, lpExitCode=0x266b258 | out: lpExitCode=0x266b258*=0x103) returned 1 [0058.967] GetLastError () returned 0x0 [0058.967] CheckRemoteDebuggerPresent (in: hProcess=0xbb4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.967] GetLastError () returned 0x0 [0058.967] GetCurrentProcessId () returned 0x13cc [0058.967] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbb8 [0058.967] GetLastError () returned 0x0 [0058.967] GetExitCodeProcess (in: hProcess=0xbb8, lpExitCode=0x266b30c | out: lpExitCode=0x266b30c*=0x103) returned 1 [0058.967] GetLastError () returned 0x0 [0058.967] CheckRemoteDebuggerPresent (in: hProcess=0xbb8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.967] GetLastError () returned 0x0 [0058.968] GetCurrentProcessId () returned 0x13cc [0058.968] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbbc [0058.968] GetLastError () returned 0x0 [0058.968] GetExitCodeProcess (in: hProcess=0xbbc, lpExitCode=0x266b3c0 | out: lpExitCode=0x266b3c0*=0x103) returned 1 [0058.968] GetLastError () returned 0x0 [0058.968] CheckRemoteDebuggerPresent (in: hProcess=0xbbc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.968] GetLastError () returned 0x0 [0058.968] GetCurrentProcessId () returned 0x13cc [0058.968] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbc0 [0058.968] GetLastError () returned 0x0 [0058.968] GetExitCodeProcess (in: hProcess=0xbc0, lpExitCode=0x266b474 | out: lpExitCode=0x266b474*=0x103) returned 1 [0058.968] GetLastError () returned 0x0 [0058.968] CheckRemoteDebuggerPresent (in: hProcess=0xbc0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.968] GetLastError () returned 0x0 [0058.968] GetCurrentProcessId () returned 0x13cc [0058.968] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbc4 [0058.969] GetLastError () returned 0x0 [0058.969] GetExitCodeProcess (in: hProcess=0xbc4, lpExitCode=0x266b528 | out: lpExitCode=0x266b528*=0x103) returned 1 [0058.969] GetLastError () returned 0x0 [0058.969] CheckRemoteDebuggerPresent (in: hProcess=0xbc4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.969] GetLastError () returned 0x0 [0058.969] GetCurrentProcessId () returned 0x13cc [0058.969] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbc8 [0058.969] GetLastError () returned 0x0 [0058.969] GetExitCodeProcess (in: hProcess=0xbc8, lpExitCode=0x266b5dc | out: lpExitCode=0x266b5dc*=0x103) returned 1 [0058.969] GetLastError () returned 0x0 [0058.969] CheckRemoteDebuggerPresent (in: hProcess=0xbc8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.969] GetLastError () returned 0x0 [0058.969] GetCurrentProcessId () returned 0x13cc [0058.969] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbcc [0058.969] GetLastError () returned 0x0 [0058.969] GetExitCodeProcess (in: hProcess=0xbcc, lpExitCode=0x266b690 | out: lpExitCode=0x266b690*=0x103) returned 1 [0058.970] GetLastError () returned 0x0 [0058.970] CheckRemoteDebuggerPresent (in: hProcess=0xbcc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.970] GetLastError () returned 0x0 [0058.970] GetCurrentProcessId () returned 0x13cc [0058.970] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbd0 [0058.970] GetLastError () returned 0x0 [0058.970] GetExitCodeProcess (in: hProcess=0xbd0, lpExitCode=0x266b744 | out: lpExitCode=0x266b744*=0x103) returned 1 [0058.970] GetLastError () returned 0x0 [0058.970] CheckRemoteDebuggerPresent (in: hProcess=0xbd0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.970] GetLastError () returned 0x0 [0058.970] GetCurrentProcessId () returned 0x13cc [0058.970] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbd4 [0058.970] GetLastError () returned 0x0 [0058.970] GetExitCodeProcess (in: hProcess=0xbd4, lpExitCode=0x266b7f8 | out: lpExitCode=0x266b7f8*=0x103) returned 1 [0058.970] GetLastError () returned 0x0 [0058.971] CheckRemoteDebuggerPresent (in: hProcess=0xbd4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.971] GetLastError () returned 0x0 [0058.971] GetCurrentProcessId () returned 0x13cc [0058.971] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbd8 [0058.971] GetLastError () returned 0x0 [0058.971] GetExitCodeProcess (in: hProcess=0xbd8, lpExitCode=0x266b8ac | out: lpExitCode=0x266b8ac*=0x103) returned 1 [0058.971] GetLastError () returned 0x0 [0058.971] CheckRemoteDebuggerPresent (in: hProcess=0xbd8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.971] GetLastError () returned 0x0 [0058.971] GetCurrentProcessId () returned 0x13cc [0058.971] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbdc [0058.971] GetLastError () returned 0x0 [0058.971] GetExitCodeProcess (in: hProcess=0xbdc, lpExitCode=0x266b960 | out: lpExitCode=0x266b960*=0x103) returned 1 [0058.971] GetLastError () returned 0x0 [0058.971] CheckRemoteDebuggerPresent (in: hProcess=0xbdc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.971] GetLastError () returned 0x0 [0058.972] GetCurrentProcessId () returned 0x13cc [0058.972] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbe0 [0058.972] GetLastError () returned 0x0 [0058.972] GetExitCodeProcess (in: hProcess=0xbe0, lpExitCode=0x266ba14 | out: lpExitCode=0x266ba14*=0x103) returned 1 [0058.972] GetLastError () returned 0x0 [0058.972] CheckRemoteDebuggerPresent (in: hProcess=0xbe0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.972] GetLastError () returned 0x0 [0058.972] GetCurrentProcessId () returned 0x13cc [0058.972] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbe4 [0058.972] GetLastError () returned 0x0 [0058.972] GetExitCodeProcess (in: hProcess=0xbe4, lpExitCode=0x266bac8 | out: lpExitCode=0x266bac8*=0x103) returned 1 [0058.972] GetLastError () returned 0x0 [0058.972] CheckRemoteDebuggerPresent (in: hProcess=0xbe4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.972] GetLastError () returned 0x0 [0058.972] GetCurrentProcessId () returned 0x13cc [0058.973] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbe8 [0058.973] GetLastError () returned 0x0 [0058.973] GetExitCodeProcess (in: hProcess=0xbe8, lpExitCode=0x266bb7c | out: lpExitCode=0x266bb7c*=0x103) returned 1 [0058.973] GetLastError () returned 0x0 [0058.973] CheckRemoteDebuggerPresent (in: hProcess=0xbe8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.973] GetLastError () returned 0x0 [0058.973] GetCurrentProcessId () returned 0x13cc [0058.973] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbec [0058.973] GetLastError () returned 0x0 [0058.973] GetExitCodeProcess (in: hProcess=0xbec, lpExitCode=0x266bc30 | out: lpExitCode=0x266bc30*=0x103) returned 1 [0058.973] GetLastError () returned 0x0 [0058.973] CheckRemoteDebuggerPresent (in: hProcess=0xbec, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.973] GetLastError () returned 0x0 [0058.973] GetCurrentProcessId () returned 0x13cc [0058.973] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbf0 [0058.974] GetLastError () returned 0x0 [0058.974] GetExitCodeProcess (in: hProcess=0xbf0, lpExitCode=0x266bce4 | out: lpExitCode=0x266bce4*=0x103) returned 1 [0058.974] GetLastError () returned 0x0 [0058.974] CheckRemoteDebuggerPresent (in: hProcess=0xbf0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.974] GetLastError () returned 0x0 [0058.974] GetCurrentProcessId () returned 0x13cc [0058.974] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbf4 [0058.974] GetLastError () returned 0x0 [0058.974] GetExitCodeProcess (in: hProcess=0xbf4, lpExitCode=0x266bd98 | out: lpExitCode=0x266bd98*=0x103) returned 1 [0058.974] GetLastError () returned 0x0 [0058.974] CheckRemoteDebuggerPresent (in: hProcess=0xbf4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.974] GetLastError () returned 0x0 [0058.974] GetCurrentProcessId () returned 0x13cc [0058.974] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbf8 [0058.974] GetLastError () returned 0x0 [0058.974] GetExitCodeProcess (in: hProcess=0xbf8, lpExitCode=0x266be4c | out: lpExitCode=0x266be4c*=0x103) returned 1 [0058.975] GetLastError () returned 0x0 [0058.975] CheckRemoteDebuggerPresent (in: hProcess=0xbf8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.975] GetLastError () returned 0x0 [0058.975] GetCurrentProcessId () returned 0x13cc [0058.975] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xbfc [0058.975] GetLastError () returned 0x0 [0058.975] GetExitCodeProcess (in: hProcess=0xbfc, lpExitCode=0x266bf00 | out: lpExitCode=0x266bf00*=0x103) returned 1 [0058.975] GetLastError () returned 0x0 [0058.975] CheckRemoteDebuggerPresent (in: hProcess=0xbfc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.975] GetLastError () returned 0x0 [0058.975] GetCurrentProcessId () returned 0x13cc [0058.975] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc04 [0058.976] GetLastError () returned 0x0 [0058.976] GetExitCodeProcess (in: hProcess=0xc04, lpExitCode=0x266bfb4 | out: lpExitCode=0x266bfb4*=0x103) returned 1 [0058.976] GetLastError () returned 0x0 [0058.976] CheckRemoteDebuggerPresent (in: hProcess=0xc04, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.976] GetLastError () returned 0x0 [0058.976] GetCurrentProcessId () returned 0x13cc [0058.976] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc08 [0058.976] GetLastError () returned 0x0 [0058.976] GetExitCodeProcess (in: hProcess=0xc08, lpExitCode=0x266c068 | out: lpExitCode=0x266c068*=0x103) returned 1 [0058.976] GetLastError () returned 0x0 [0058.976] CheckRemoteDebuggerPresent (in: hProcess=0xc08, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.976] GetLastError () returned 0x0 [0058.976] GetCurrentProcessId () returned 0x13cc [0058.976] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc0c [0058.977] GetLastError () returned 0x0 [0058.977] GetExitCodeProcess (in: hProcess=0xc0c, lpExitCode=0x266c11c | out: lpExitCode=0x266c11c*=0x103) returned 1 [0058.977] GetLastError () returned 0x0 [0058.977] CheckRemoteDebuggerPresent (in: hProcess=0xc0c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.977] GetLastError () returned 0x0 [0058.977] GetCurrentProcessId () returned 0x13cc [0058.977] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc10 [0058.977] GetLastError () returned 0x0 [0058.977] GetExitCodeProcess (in: hProcess=0xc10, lpExitCode=0x266c1d0 | out: lpExitCode=0x266c1d0*=0x103) returned 1 [0058.977] GetLastError () returned 0x0 [0058.977] CheckRemoteDebuggerPresent (in: hProcess=0xc10, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.977] GetLastError () returned 0x0 [0058.977] GetCurrentProcessId () returned 0x13cc [0058.977] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc14 [0058.977] GetLastError () returned 0x0 [0058.978] GetExitCodeProcess (in: hProcess=0xc14, lpExitCode=0x266c284 | out: lpExitCode=0x266c284*=0x103) returned 1 [0058.978] GetLastError () returned 0x0 [0058.978] CheckRemoteDebuggerPresent (in: hProcess=0xc14, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.978] GetLastError () returned 0x0 [0058.978] GetCurrentProcessId () returned 0x13cc [0058.978] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc18 [0058.978] GetLastError () returned 0x0 [0058.978] GetExitCodeProcess (in: hProcess=0xc18, lpExitCode=0x266c338 | out: lpExitCode=0x266c338*=0x103) returned 1 [0058.978] GetLastError () returned 0x0 [0058.978] CheckRemoteDebuggerPresent (in: hProcess=0xc18, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.978] GetLastError () returned 0x0 [0058.978] GetCurrentProcessId () returned 0x13cc [0058.978] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc1c [0058.978] GetLastError () returned 0x0 [0058.978] GetExitCodeProcess (in: hProcess=0xc1c, lpExitCode=0x266c3ec | out: lpExitCode=0x266c3ec*=0x103) returned 1 [0058.978] GetLastError () returned 0x0 [0058.978] CheckRemoteDebuggerPresent (in: hProcess=0xc1c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.979] GetLastError () returned 0x0 [0058.979] GetCurrentProcessId () returned 0x13cc [0058.979] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc20 [0058.979] GetLastError () returned 0x0 [0058.979] GetExitCodeProcess (in: hProcess=0xc20, lpExitCode=0x266c4a0 | out: lpExitCode=0x266c4a0*=0x103) returned 1 [0058.979] GetLastError () returned 0x0 [0058.979] CheckRemoteDebuggerPresent (in: hProcess=0xc20, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.979] GetLastError () returned 0x0 [0058.979] GetCurrentProcessId () returned 0x13cc [0058.979] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc24 [0058.979] GetLastError () returned 0x0 [0058.979] GetExitCodeProcess (in: hProcess=0xc24, lpExitCode=0x266c554 | out: lpExitCode=0x266c554*=0x103) returned 1 [0058.979] GetLastError () returned 0x0 [0058.980] CheckRemoteDebuggerPresent (in: hProcess=0xc24, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.980] GetLastError () returned 0x0 [0058.980] GetCurrentProcessId () returned 0x13cc [0058.980] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc28 [0058.980] GetLastError () returned 0x0 [0058.980] GetExitCodeProcess (in: hProcess=0xc28, lpExitCode=0x266c608 | out: lpExitCode=0x266c608*=0x103) returned 1 [0058.981] GetLastError () returned 0x0 [0058.981] CheckRemoteDebuggerPresent (in: hProcess=0xc28, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.981] GetLastError () returned 0x0 [0058.981] GetCurrentProcessId () returned 0x13cc [0058.981] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc2c [0058.981] GetLastError () returned 0x0 [0058.981] GetExitCodeProcess (in: hProcess=0xc2c, lpExitCode=0x266c6bc | out: lpExitCode=0x266c6bc*=0x103) returned 1 [0058.981] GetLastError () returned 0x0 [0058.981] CheckRemoteDebuggerPresent (in: hProcess=0xc2c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.981] GetLastError () returned 0x0 [0058.981] GetCurrentProcessId () returned 0x13cc [0058.981] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc30 [0058.981] GetLastError () returned 0x0 [0058.981] GetExitCodeProcess (in: hProcess=0xc30, lpExitCode=0x266c770 | out: lpExitCode=0x266c770*=0x103) returned 1 [0058.981] GetLastError () returned 0x0 [0058.981] CheckRemoteDebuggerPresent (in: hProcess=0xc30, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.982] GetLastError () returned 0x0 [0058.982] GetCurrentProcessId () returned 0x13cc [0058.982] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc34 [0058.982] GetLastError () returned 0x0 [0058.982] GetExitCodeProcess (in: hProcess=0xc34, lpExitCode=0x266c824 | out: lpExitCode=0x266c824*=0x103) returned 1 [0058.982] GetLastError () returned 0x0 [0058.982] CheckRemoteDebuggerPresent (in: hProcess=0xc34, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.982] GetLastError () returned 0x0 [0058.982] GetCurrentProcessId () returned 0x13cc [0058.982] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc38 [0058.982] GetLastError () returned 0x0 [0058.982] GetExitCodeProcess (in: hProcess=0xc38, lpExitCode=0x266c8d8 | out: lpExitCode=0x266c8d8*=0x103) returned 1 [0058.982] GetLastError () returned 0x0 [0058.982] CheckRemoteDebuggerPresent (in: hProcess=0xc38, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.982] GetLastError () returned 0x0 [0058.982] GetCurrentProcessId () returned 0x13cc [0058.983] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc3c [0058.983] GetLastError () returned 0x0 [0058.983] GetExitCodeProcess (in: hProcess=0xc3c, lpExitCode=0x266c98c | out: lpExitCode=0x266c98c*=0x103) returned 1 [0058.983] GetLastError () returned 0x0 [0058.983] CheckRemoteDebuggerPresent (in: hProcess=0xc3c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.983] GetLastError () returned 0x0 [0058.983] GetCurrentProcessId () returned 0x13cc [0058.983] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc40 [0058.983] GetLastError () returned 0x0 [0058.983] GetExitCodeProcess (in: hProcess=0xc40, lpExitCode=0x266ca40 | out: lpExitCode=0x266ca40*=0x103) returned 1 [0058.983] GetLastError () returned 0x0 [0058.983] CheckRemoteDebuggerPresent (in: hProcess=0xc40, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.983] GetLastError () returned 0x0 [0058.983] GetCurrentProcessId () returned 0x13cc [0058.983] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc44 [0058.983] GetLastError () returned 0x0 [0058.983] GetExitCodeProcess (in: hProcess=0xc44, lpExitCode=0x266caf4 | out: lpExitCode=0x266caf4*=0x103) returned 1 [0058.984] GetLastError () returned 0x0 [0058.984] CheckRemoteDebuggerPresent (in: hProcess=0xc44, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.984] GetLastError () returned 0x0 [0058.984] GetCurrentProcessId () returned 0x13cc [0058.984] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc48 [0058.984] GetLastError () returned 0x0 [0058.984] GetExitCodeProcess (in: hProcess=0xc48, lpExitCode=0x266cba8 | out: lpExitCode=0x266cba8*=0x103) returned 1 [0058.984] GetLastError () returned 0x0 [0058.984] CheckRemoteDebuggerPresent (in: hProcess=0xc48, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.984] GetLastError () returned 0x0 [0058.984] GetCurrentProcessId () returned 0x13cc [0058.984] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc4c [0058.984] GetLastError () returned 0x0 [0058.984] GetExitCodeProcess (in: hProcess=0xc4c, lpExitCode=0x266cc5c | out: lpExitCode=0x266cc5c*=0x103) returned 1 [0058.984] GetLastError () returned 0x0 [0058.984] CheckRemoteDebuggerPresent (in: hProcess=0xc4c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.985] GetLastError () returned 0x0 [0058.985] GetCurrentProcessId () returned 0x13cc [0058.985] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc50 [0058.985] GetLastError () returned 0x0 [0058.985] GetExitCodeProcess (in: hProcess=0xc50, lpExitCode=0x266cd10 | out: lpExitCode=0x266cd10*=0x103) returned 1 [0058.985] GetLastError () returned 0x0 [0058.985] CheckRemoteDebuggerPresent (in: hProcess=0xc50, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.985] GetLastError () returned 0x0 [0058.985] GetCurrentProcessId () returned 0x13cc [0058.985] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc54 [0058.985] GetLastError () returned 0x0 [0058.985] GetExitCodeProcess (in: hProcess=0xc54, lpExitCode=0x266cdc4 | out: lpExitCode=0x266cdc4*=0x103) returned 1 [0058.985] GetLastError () returned 0x0 [0058.985] CheckRemoteDebuggerPresent (in: hProcess=0xc54, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.985] GetLastError () returned 0x0 [0058.985] GetCurrentProcessId () returned 0x13cc [0058.985] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc58 [0058.986] GetLastError () returned 0x0 [0058.986] GetExitCodeProcess (in: hProcess=0xc58, lpExitCode=0x266ce78 | out: lpExitCode=0x266ce78*=0x103) returned 1 [0058.986] GetLastError () returned 0x0 [0058.986] CheckRemoteDebuggerPresent (in: hProcess=0xc58, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.986] GetLastError () returned 0x0 [0058.986] GetCurrentProcessId () returned 0x13cc [0058.986] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc5c [0058.986] GetLastError () returned 0x0 [0058.986] GetExitCodeProcess (in: hProcess=0xc5c, lpExitCode=0x266cf2c | out: lpExitCode=0x266cf2c*=0x103) returned 1 [0058.986] GetLastError () returned 0x0 [0058.986] CheckRemoteDebuggerPresent (in: hProcess=0xc5c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.986] GetLastError () returned 0x0 [0058.986] GetCurrentProcessId () returned 0x13cc [0058.986] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc60 [0058.986] GetLastError () returned 0x0 [0058.986] GetExitCodeProcess (in: hProcess=0xc60, lpExitCode=0x266cfe0 | out: lpExitCode=0x266cfe0*=0x103) returned 1 [0058.986] GetLastError () returned 0x0 [0058.986] CheckRemoteDebuggerPresent (in: hProcess=0xc60, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.986] GetLastError () returned 0x0 [0058.987] GetCurrentProcessId () returned 0x13cc [0058.987] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc64 [0058.987] GetLastError () returned 0x0 [0058.987] GetExitCodeProcess (in: hProcess=0xc64, lpExitCode=0x266d094 | out: lpExitCode=0x266d094*=0x103) returned 1 [0058.987] GetLastError () returned 0x0 [0058.987] CheckRemoteDebuggerPresent (in: hProcess=0xc64, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.987] GetLastError () returned 0x0 [0058.987] GetCurrentProcessId () returned 0x13cc [0058.987] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc68 [0058.987] GetLastError () returned 0x0 [0058.987] GetExitCodeProcess (in: hProcess=0xc68, lpExitCode=0x266d148 | out: lpExitCode=0x266d148*=0x103) returned 1 [0058.987] GetLastError () returned 0x0 [0058.987] CheckRemoteDebuggerPresent (in: hProcess=0xc68, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.987] GetLastError () returned 0x0 [0058.987] GetCurrentProcessId () returned 0x13cc [0058.987] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc6c [0058.987] GetLastError () returned 0x0 [0058.987] GetExitCodeProcess (in: hProcess=0xc6c, lpExitCode=0x266d1fc | out: lpExitCode=0x266d1fc*=0x103) returned 1 [0058.987] GetLastError () returned 0x0 [0058.987] CheckRemoteDebuggerPresent (in: hProcess=0xc6c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.988] GetLastError () returned 0x0 [0058.988] GetCurrentProcessId () returned 0x13cc [0058.988] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc70 [0058.988] GetLastError () returned 0x0 [0058.988] GetExitCodeProcess (in: hProcess=0xc70, lpExitCode=0x266d2b0 | out: lpExitCode=0x266d2b0*=0x103) returned 1 [0058.988] GetLastError () returned 0x0 [0058.988] CheckRemoteDebuggerPresent (in: hProcess=0xc70, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.988] GetLastError () returned 0x0 [0058.988] GetCurrentProcessId () returned 0x13cc [0058.988] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc74 [0058.988] GetLastError () returned 0x0 [0058.988] GetExitCodeProcess (in: hProcess=0xc74, lpExitCode=0x266d364 | out: lpExitCode=0x266d364*=0x103) returned 1 [0058.988] GetLastError () returned 0x0 [0058.988] CheckRemoteDebuggerPresent (in: hProcess=0xc74, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.988] GetLastError () returned 0x0 [0058.988] GetCurrentProcessId () returned 0x13cc [0058.988] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc78 [0058.988] GetLastError () returned 0x0 [0058.988] GetExitCodeProcess (in: hProcess=0xc78, lpExitCode=0x266d418 | out: lpExitCode=0x266d418*=0x103) returned 1 [0058.989] GetLastError () returned 0x0 [0058.989] CheckRemoteDebuggerPresent (in: hProcess=0xc78, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.989] GetLastError () returned 0x0 [0058.989] GetCurrentProcessId () returned 0x13cc [0058.989] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc7c [0058.989] GetLastError () returned 0x0 [0058.989] GetExitCodeProcess (in: hProcess=0xc7c, lpExitCode=0x266d4cc | out: lpExitCode=0x266d4cc*=0x103) returned 1 [0058.989] GetLastError () returned 0x0 [0058.989] CheckRemoteDebuggerPresent (in: hProcess=0xc7c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.989] GetLastError () returned 0x0 [0058.989] GetCurrentProcessId () returned 0x13cc [0058.989] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc80 [0058.989] GetLastError () returned 0x0 [0058.989] GetExitCodeProcess (in: hProcess=0xc80, lpExitCode=0x266d580 | out: lpExitCode=0x266d580*=0x103) returned 1 [0058.989] GetLastError () returned 0x0 [0058.989] CheckRemoteDebuggerPresent (in: hProcess=0xc80, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.989] GetLastError () returned 0x0 [0058.989] GetCurrentProcessId () returned 0x13cc [0058.989] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc84 [0058.990] GetLastError () returned 0x0 [0058.990] GetExitCodeProcess (in: hProcess=0xc84, lpExitCode=0x266d634 | out: lpExitCode=0x266d634*=0x103) returned 1 [0058.990] GetLastError () returned 0x0 [0058.990] CheckRemoteDebuggerPresent (in: hProcess=0xc84, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.990] GetLastError () returned 0x0 [0058.990] GetCurrentProcessId () returned 0x13cc [0058.990] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc88 [0058.990] GetLastError () returned 0x0 [0058.990] GetExitCodeProcess (in: hProcess=0xc88, lpExitCode=0x266d6e8 | out: lpExitCode=0x266d6e8*=0x103) returned 1 [0058.990] GetLastError () returned 0x0 [0058.990] CheckRemoteDebuggerPresent (in: hProcess=0xc88, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.990] GetLastError () returned 0x0 [0058.990] GetCurrentProcessId () returned 0x13cc [0058.990] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc8c [0058.990] GetLastError () returned 0x0 [0058.990] GetExitCodeProcess (in: hProcess=0xc8c, lpExitCode=0x266d79c | out: lpExitCode=0x266d79c*=0x103) returned 1 [0058.990] GetLastError () returned 0x0 [0058.990] CheckRemoteDebuggerPresent (in: hProcess=0xc8c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.990] GetLastError () returned 0x0 [0058.991] GetCurrentProcessId () returned 0x13cc [0058.991] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc90 [0058.991] GetLastError () returned 0x0 [0058.991] GetExitCodeProcess (in: hProcess=0xc90, lpExitCode=0x266d850 | out: lpExitCode=0x266d850*=0x103) returned 1 [0058.991] GetLastError () returned 0x0 [0058.991] CheckRemoteDebuggerPresent (in: hProcess=0xc90, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.991] GetLastError () returned 0x0 [0058.991] GetCurrentProcessId () returned 0x13cc [0058.991] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc94 [0058.991] GetLastError () returned 0x0 [0058.991] GetExitCodeProcess (in: hProcess=0xc94, lpExitCode=0x266d904 | out: lpExitCode=0x266d904*=0x103) returned 1 [0058.991] GetLastError () returned 0x0 [0058.991] CheckRemoteDebuggerPresent (in: hProcess=0xc94, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.991] GetLastError () returned 0x0 [0058.991] GetCurrentProcessId () returned 0x13cc [0058.991] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc98 [0058.991] GetLastError () returned 0x0 [0058.991] GetExitCodeProcess (in: hProcess=0xc98, lpExitCode=0x266d9b8 | out: lpExitCode=0x266d9b8*=0x103) returned 1 [0058.991] GetLastError () returned 0x0 [0058.991] CheckRemoteDebuggerPresent (in: hProcess=0xc98, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.992] GetLastError () returned 0x0 [0058.992] GetCurrentProcessId () returned 0x13cc [0058.992] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xc9c [0058.992] GetLastError () returned 0x0 [0058.992] GetExitCodeProcess (in: hProcess=0xc9c, lpExitCode=0x266da6c | out: lpExitCode=0x266da6c*=0x103) returned 1 [0058.992] GetLastError () returned 0x0 [0058.992] CheckRemoteDebuggerPresent (in: hProcess=0xc9c, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.992] GetLastError () returned 0x0 [0058.992] GetCurrentProcessId () returned 0x13cc [0058.992] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xca0 [0058.992] GetLastError () returned 0x0 [0058.992] GetExitCodeProcess (in: hProcess=0xca0, lpExitCode=0x266db20 | out: lpExitCode=0x266db20*=0x103) returned 1 [0058.992] GetLastError () returned 0x0 [0058.992] CheckRemoteDebuggerPresent (in: hProcess=0xca0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.992] GetLastError () returned 0x0 [0058.992] GetCurrentProcessId () returned 0x13cc [0058.992] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xca4 [0058.992] GetLastError () returned 0x0 [0058.992] GetExitCodeProcess (in: hProcess=0xca4, lpExitCode=0x266dbd4 | out: lpExitCode=0x266dbd4*=0x103) returned 1 [0058.993] GetLastError () returned 0x0 [0058.993] CheckRemoteDebuggerPresent (in: hProcess=0xca4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.993] GetLastError () returned 0x0 [0058.993] GetCurrentProcessId () returned 0x13cc [0058.993] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xca8 [0058.993] GetLastError () returned 0x0 [0058.993] GetExitCodeProcess (in: hProcess=0xca8, lpExitCode=0x266dc88 | out: lpExitCode=0x266dc88*=0x103) returned 1 [0058.993] GetLastError () returned 0x0 [0058.993] CheckRemoteDebuggerPresent (in: hProcess=0xca8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.993] GetLastError () returned 0x0 [0058.993] GetCurrentProcessId () returned 0x13cc [0058.993] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcac [0058.993] GetLastError () returned 0x0 [0058.993] GetExitCodeProcess (in: hProcess=0xcac, lpExitCode=0x266dd3c | out: lpExitCode=0x266dd3c*=0x103) returned 1 [0058.993] GetLastError () returned 0x0 [0058.993] CheckRemoteDebuggerPresent (in: hProcess=0xcac, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.993] GetLastError () returned 0x0 [0058.993] GetCurrentProcessId () returned 0x13cc [0058.993] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcb0 [0058.994] GetLastError () returned 0x0 [0058.994] GetExitCodeProcess (in: hProcess=0xcb0, lpExitCode=0x266ddf0 | out: lpExitCode=0x266ddf0*=0x103) returned 1 [0058.994] GetLastError () returned 0x0 [0058.994] CheckRemoteDebuggerPresent (in: hProcess=0xcb0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.994] GetLastError () returned 0x0 [0058.994] GetCurrentProcessId () returned 0x13cc [0058.994] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcb4 [0058.994] GetLastError () returned 0x0 [0058.994] GetExitCodeProcess (in: hProcess=0xcb4, lpExitCode=0x266dea4 | out: lpExitCode=0x266dea4*=0x103) returned 1 [0058.994] GetLastError () returned 0x0 [0058.994] CheckRemoteDebuggerPresent (in: hProcess=0xcb4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.994] GetLastError () returned 0x0 [0058.994] GetCurrentProcessId () returned 0x13cc [0058.994] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcb8 [0058.994] GetLastError () returned 0x0 [0058.994] GetExitCodeProcess (in: hProcess=0xcb8, lpExitCode=0x266df58 | out: lpExitCode=0x266df58*=0x103) returned 1 [0058.994] GetLastError () returned 0x0 [0058.994] CheckRemoteDebuggerPresent (in: hProcess=0xcb8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.994] GetLastError () returned 0x0 [0058.995] GetCurrentProcessId () returned 0x13cc [0058.995] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcbc [0058.995] GetLastError () returned 0x0 [0058.995] GetExitCodeProcess (in: hProcess=0xcbc, lpExitCode=0x266e00c | out: lpExitCode=0x266e00c*=0x103) returned 1 [0058.995] GetLastError () returned 0x0 [0058.995] CheckRemoteDebuggerPresent (in: hProcess=0xcbc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.995] GetLastError () returned 0x0 [0058.995] GetCurrentProcessId () returned 0x13cc [0058.995] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcc0 [0058.995] GetLastError () returned 0x0 [0058.996] GetExitCodeProcess (in: hProcess=0xcc0, lpExitCode=0x266e0c0 | out: lpExitCode=0x266e0c0*=0x103) returned 1 [0058.996] GetLastError () returned 0x0 [0058.996] CheckRemoteDebuggerPresent (in: hProcess=0xcc0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.996] GetLastError () returned 0x0 [0058.996] GetCurrentProcessId () returned 0x13cc [0058.996] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcc4 [0058.996] GetLastError () returned 0x0 [0058.996] GetExitCodeProcess (in: hProcess=0xcc4, lpExitCode=0x266e174 | out: lpExitCode=0x266e174*=0x103) returned 1 [0058.996] GetLastError () returned 0x0 [0058.996] CheckRemoteDebuggerPresent (in: hProcess=0xcc4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.996] GetLastError () returned 0x0 [0058.996] GetCurrentProcessId () returned 0x13cc [0058.996] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcc8 [0058.996] GetLastError () returned 0x0 [0058.996] GetExitCodeProcess (in: hProcess=0xcc8, lpExitCode=0x266e228 | out: lpExitCode=0x266e228*=0x103) returned 1 [0058.996] GetLastError () returned 0x0 [0058.996] CheckRemoteDebuggerPresent (in: hProcess=0xcc8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.996] GetLastError () returned 0x0 [0058.996] GetCurrentProcessId () returned 0x13cc [0058.997] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xccc [0058.997] GetLastError () returned 0x0 [0058.997] GetExitCodeProcess (in: hProcess=0xccc, lpExitCode=0x266e2dc | out: lpExitCode=0x266e2dc*=0x103) returned 1 [0058.997] GetLastError () returned 0x0 [0058.997] CheckRemoteDebuggerPresent (in: hProcess=0xccc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.997] GetLastError () returned 0x0 [0058.997] GetCurrentProcessId () returned 0x13cc [0058.997] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcd0 [0058.997] GetLastError () returned 0x0 [0058.997] GetExitCodeProcess (in: hProcess=0xcd0, lpExitCode=0x266e390 | out: lpExitCode=0x266e390*=0x103) returned 1 [0058.997] GetLastError () returned 0x0 [0058.997] CheckRemoteDebuggerPresent (in: hProcess=0xcd0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.997] GetLastError () returned 0x0 [0058.997] GetCurrentProcessId () returned 0x13cc [0058.997] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcd4 [0058.997] GetLastError () returned 0x0 [0058.997] GetExitCodeProcess (in: hProcess=0xcd4, lpExitCode=0x266e444 | out: lpExitCode=0x266e444*=0x103) returned 1 [0058.997] GetLastError () returned 0x0 [0058.997] CheckRemoteDebuggerPresent (in: hProcess=0xcd4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.997] GetLastError () returned 0x0 [0058.998] GetCurrentProcessId () returned 0x13cc [0058.998] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcd8 [0058.998] GetLastError () returned 0x0 [0058.998] GetExitCodeProcess (in: hProcess=0xcd8, lpExitCode=0x266e4f8 | out: lpExitCode=0x266e4f8*=0x103) returned 1 [0058.998] GetLastError () returned 0x0 [0058.998] CheckRemoteDebuggerPresent (in: hProcess=0xcd8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.998] GetLastError () returned 0x0 [0058.998] GetCurrentProcessId () returned 0x13cc [0058.998] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xcdc [0058.998] GetLastError () returned 0x0 [0058.998] GetExitCodeProcess (in: hProcess=0xcdc, lpExitCode=0x266e5ac | out: lpExitCode=0x266e5ac*=0x103) returned 1 [0058.998] GetLastError () returned 0x0 [0058.998] CheckRemoteDebuggerPresent (in: hProcess=0xcdc, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.998] GetLastError () returned 0x0 [0058.998] GetCurrentProcessId () returned 0x13cc [0058.998] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xce0 [0058.998] GetLastError () returned 0x0 [0058.998] GetExitCodeProcess (in: hProcess=0xce0, lpExitCode=0x266e660 | out: lpExitCode=0x266e660*=0x103) returned 1 [0058.998] GetLastError () returned 0x0 [0058.999] CheckRemoteDebuggerPresent (in: hProcess=0xce0, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.999] GetLastError () returned 0x0 [0058.999] GetCurrentProcessId () returned 0x13cc [0058.999] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xce4 [0058.999] GetLastError () returned 0x0 [0058.999] GetExitCodeProcess (in: hProcess=0xce4, lpExitCode=0x266e714 | out: lpExitCode=0x266e714*=0x103) returned 1 [0058.999] GetLastError () returned 0x0 [0058.999] CheckRemoteDebuggerPresent (in: hProcess=0xce4, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.999] GetLastError () returned 0x0 [0058.999] GetCurrentProcessId () returned 0x13cc [0058.999] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x13cc) returned 0xce8 [0058.999] GetLastError () returned 0x0 [0058.999] GetExitCodeProcess (in: hProcess=0xce8, lpExitCode=0x266e7c8 | out: lpExitCode=0x266e7c8*=0x103) returned 1 [0058.999] GetLastError () returned 0x0 [0058.999] CheckRemoteDebuggerPresent (in: hProcess=0xce8, pbDebuggerPresent=0x53eb00 | out: pbDebuggerPresent=0x53eb00) returned 1 [0058.999] GetLastError () returned 0x0 [0058.999] GetCurrentProcessId () returned 0x13cc [0059.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0059.405] GetLastError () returned 0x0 [0059.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0059.420] GetLastError () returned 0x0 [0059.421] SetErrorMode (uMode=0x1) returned 0x0 [0059.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\zsywqjjw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x12fc [0059.423] GetLastError () returned 0x0 [0059.424] GetFileType (hFile=0x12fc) returned 0x1 [0059.424] SetErrorMode (uMode=0x0) returned 0x1 [0059.424] GetFileType (hFile=0x12fc) returned 0x1 [0059.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0059.433] GetLastError () returned 0x0 [0059.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0059.440] GetLastError () returned 0x0 [0059.440] SetErrorMode (uMode=0x1) returned 0x0 [0059.440] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\zsywqjjw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x38b8 [0059.440] GetLastError () returned 0x0 [0059.440] GetFileType (hFile=0x38b8) returned 0x1 [0059.440] SetErrorMode (uMode=0x0) returned 0x1 [0059.440] GetFileType (hFile=0x38b8) returned 0x1 [0059.442] GetFileSize (in: hFile=0x38b8, lpFileSizeHigh=0x53ec70 | out: lpFileSizeHigh=0x53ec70*=0x0) returned 0x3ea00 [0059.442] GetLastError () returned 0x0 [0059.444] ReadFile (in: hFile=0x38b8, lpBuffer=0x3654268, nNumberOfBytesToRead=0x3ea00, lpNumberOfBytesRead=0x53ec18, lpOverlapped=0x0 | out: lpBuffer=0x3654268*, lpNumberOfBytesRead=0x53ec18*=0x3ea00, lpOverlapped=0x0) returned 1 [0059.447] GetLastError () returned 0x0 [0059.450] CloseHandle (hObject=0x38b8) returned 1 [0059.450] GetLastError () returned 0x0 [0059.451] ReadFile (in: hFile=0x12fc, lpBuffer=0x3692c88, nNumberOfBytesToRead=0x3e9e0, lpNumberOfBytesRead=0x53ec34, lpOverlapped=0x0 | out: lpBuffer=0x3692c88*, lpNumberOfBytesRead=0x53ec34*=0x3e9e0, lpOverlapped=0x0) returned 1 [0059.455] GetLastError () returned 0x0 [0059.569] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x53eb9c | out: pfEnabled=0x53eb9c) returned 0x0 [0059.570] GetVersionExW (in: lpVersionInformation=0x75a840*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x75a840*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0059.571] GetLastError () returned 0x0 [0059.624] GetFileSize (in: hFile=0x12fc, lpFileSizeHigh=0x53eca4 | out: lpFileSizeHigh=0x53eca4*=0x0) returned 0x3ea00 [0059.624] GetLastError () returned 0x2 [0059.627] SetFilePointer (in: hFile=0x12fc, lDistanceToMove=256480, lpDistanceToMoveHigh=0x53ec24*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x53ec24*=0) returned 0x3e9e0 [0059.627] GetLastError () returned 0x2 [0059.627] ReadFile (in: hFile=0x12fc, lpBuffer=0x2b064f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x53ec34, lpOverlapped=0x0 | out: lpBuffer=0x2b064f4*, lpNumberOfBytesRead=0x53ec34*=0x20, lpOverlapped=0x0) returned 1 [0059.627] GetLastError () returned 0x2 [0062.882] VirtualProtect (in: lpAddress=0x8a0168, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x2) returned 1 [0062.883] VirtualProtect (in: lpAddress=0x8be000, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x20) returned 1 [0062.884] VirtualProtect (in: lpAddress=0x8c247c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x20) returned 1 [0062.884] VirtualProtect (in: lpAddress=0x8a0178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x40) returned 1 [0062.930] VirtualProtect (in: lpAddress=0x8a01a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x40) returned 1 [0062.930] VirtualProtect (in: lpAddress=0x8a01c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x40) returned 1 [0062.931] VirtualProtect (in: lpAddress=0x8a01f0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x40) returned 1 [0062.931] VirtualProtect (in: lpAddress=0x8a0218, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x53ed28 | out: lpflOldProtect=0x53ed28*=0x40) returned 1 [0063.136] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76750000 [0063.136] GetLastError () returned 0x0 [0063.199] GetProcAddress (hModule=0x76750000, lpProcName="IsDebuggerPresent") returned 0x76765930 [0063.203] IsDebuggerPresent () returned 0 [0063.212] GetCurrentProcessId () returned 0x13cc [0063.220] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x13cc) returned 0x34bc [0063.325] GetProcAddress (hModule=0x76750000, lpProcName="CheckRemoteDebuggerPresent") returned 0x767642f0 [0063.329] CheckRemoteDebuggerPresent (in: hProcess=0x34bc, pbDebuggerPresent=0x53eca4 | out: pbDebuggerPresent=0x53eca4) returned 1 [0063.336] CloseHandle (hObject=0x34bc) returned 1 [0063.336] CloseHandle (hObject=0x12345678) returned 0 [0065.280] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0065.282] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleHandleA") returned 0x767650b0 [0065.396] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0065.396] GetLastError () returned 0x6 [0065.397] GetModuleHandleA (lpModuleName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe") returned 0x8a0000 [0065.397] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0065.397] GetProcAddress (hModule=0x76750000, lpProcName="FindResourceA") returned 0x767a27c0 [0065.642] FindResourceA (hModule=0x8a0000, lpName="x5vfvsqh", lpType="RC_IMAGE") returned 0x8d80f0 [0065.643] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0065.643] GetProcAddress (hModule=0x76750000, lpProcName="SizeofResource") returned 0x76766740 [0065.706] SizeofResource (hModule=0x8a0000, hResInfo=0x8d80f0) returned 0x8a00 [0065.707] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0065.707] GetProcAddress (hModule=0x76750000, lpProcName="LoadResource") returned 0x76765b00 [0065.719] LoadResource (hModule=0x8a0000, hResInfo=0x8d80f0) returned 0x8d8154 [0066.083] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", nBufferLength=0x105, lpBuffer=0x53e650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zsywqjjw.exe", lpFilePart=0x0) returned 0x24 [0066.083] GetLastError () returned 0x6 [0066.088] GetSystemDirectoryW (in: lpBuffer=0x75a840, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0066.088] GetLastError () returned 0x6 [0066.088] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x105, lpBuffer=0x53e658, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0066.088] GetLastError () returned 0x6 [0066.151] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x53e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0066.151] GetLastError () returned 0x6 [0066.152] GetVersionExW (in: lpVersionInformation=0x75a840*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x75a840*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0066.152] GetLastError () returned 0x6 [0066.152] SetErrorMode (uMode=0x1) returned 0x0 [0066.153] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)" (normalized: "c:\\program files (x86)"), fInfoLevelId=0x0, lpFileInformation=0x53eb2c | out: lpFileInformation=0x53eb2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0066.153] GetLastError () returned 0x6 [0066.153] SetErrorMode (uMode=0x0) returned 0x1 [0066.153] GetSystemDirectoryW (in: lpBuffer=0x75a840, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0066.153] GetLastError () returned 0x6 [0066.154] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x105, lpBuffer=0x53e658, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0066.154] GetLastError () returned 0x6 [0066.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework", nBufferLength=0x105, lpBuffer=0x53e604, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework", lpFilePart=0x0) returned 0x22 [0066.240] GetLastError () returned 0x0 [0066.243] SetErrorMode (uMode=0x1) returned 0x0 [0066.246] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\*", lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17eab434, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe94e8a7e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe94e8a7e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75a320 [0066.246] GetLastError () returned 0x0 [0066.247] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17eab434, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe94e8a7e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe94e8a7e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.248] GetLastError () returned 0x0 [0066.248] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57280f43, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57280f43, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x94eee300, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x15710, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETFXSBS10.exe", cAlternateFileName="")) returned 1 [0066.248] GetLastError () returned 0x0 [0066.248] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c5251e, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe52bf781, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe52e582a, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfxsbs12.hkf", cAlternateFileName="NETFXS~1.HKF")) returned 1 [0066.248] GetLastError () returned 0x0 [0066.248] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f461ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f461ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f461ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp10.dll", cAlternateFileName="")) returned 1 [0066.248] GetLastError () returned 0x0 [0066.249] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f6c457, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f6c457, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f6c457, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp20_mscorwks.dll", cAlternateFileName="")) returned 1 [0066.249] GetLastError () returned 0x0 [0066.249] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f1ff85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f1ff85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f1ff85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp20_perfcounter.dll", cAlternateFileName="")) returned 1 [0066.249] GetLastError () returned 0x0 [0066.249] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f1ff85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f1ff85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f1ff85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_diasymreader.dll", cAlternateFileName="")) returned 1 [0066.249] GetLastError () returned 0x0 [0066.249] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572a71bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x572a71bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x94eee300, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x3848, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_iehost.dll", cAlternateFileName="")) returned 1 [0066.249] GetLastError () returned 0x0 [0066.249] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ef9d22, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26ef9d22, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26ef9d22, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_microsoft.jscript.dll", cAlternateFileName="")) returned 1 [0066.249] GetLastError () returned 0x0 [0066.250] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572a71bf, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x572a71bf, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x94eee300, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x3848, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_microsoft.vsa.vb.codedomprocessor.dll", cAlternateFileName="")) returned 1 [0066.250] GetLastError () returned 0x0 [0066.250] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f6c457, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f6c457, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f6c457, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_mscordbi.dll", cAlternateFileName="")) returned 1 [0066.250] GetLastError () returned 0x0 [0066.250] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f6c457, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f6c457, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f6c457, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_mscorrc.dll", cAlternateFileName="")) returned 1 [0066.250] GetLastError () returned 0x0 [0066.251] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f1ff85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f1ff85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f1ff85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_mscorsec.dll", cAlternateFileName="")) returned 1 [0066.251] GetLastError () returned 0x0 [0066.251] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f461ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f461ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f461ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_system.configuration.install.dll", cAlternateFileName="")) returned 1 [0066.251] GetLastError () returned 0x0 [0066.251] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f1ff85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f1ff85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f1ff85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_system.data.dll", cAlternateFileName="")) returned 1 [0066.251] GetLastError () returned 0x0 [0066.251] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f461ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f461ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f461ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_system.enterpriseservices.dll", cAlternateFileName="")) returned 1 [0066.251] GetLastError () returned 0x0 [0066.252] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572cd3da, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x572cd3da, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x94eee300, ftLastWriteTime.dwHighDateTime=0x1d2837d, nFileSizeHigh=0x0, nFileSizeLow=0x3848, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_VsaVb7rt.dll", cAlternateFileName="")) returned 1 [0066.252] GetLastError () returned 0x0 [0066.252] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ef9d22, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26ef9d22, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26ef9d22, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_wminet_utils.dll", cAlternateFileName="")) returned 1 [0066.252] GetLastError () returned 0x0 [0066.252] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f6c457, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26f6c457, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26f6c457, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedReg12.dll", cAlternateFileName="")) returned 1 [0066.252] GetLastError () returned 0x0 [0066.252] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c227, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xeff313f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71423c43, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0.3705", cAlternateFileName="V10~1.370")) returned 1 [0066.253] GetLastError () returned 0x0 [0066.253] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c227, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x71423c43, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71423c43, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.1.4322", cAlternateFileName="V11~1.432")) returned 1 [0066.253] GetLastError () returned 0x0 [0066.253] FindNextFileW (in: hFindFile=0x75a320, lpFindFileData=0x75a840 | out: lpFindFileData=0x75a840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17eab434, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe93ddbad, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe93ddbad, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2.0.50727", cAlternateFileName="V20~1.507")) returned 1 [0066.253] GetLastError () returned 0x0 [0066.254] GetLastError () returned 0x0 [0066.254] GetLastError () returned 0x0 [0066.254] GetLastError () returned 0x0 [0066.255] GetLastError () returned 0x12 [0066.972] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0066.973] GetProcAddress (hModule=0x76750000, lpProcName="CreateProcessA") returned 0x767645b0 [0067.090] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x267a2d0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2679f98 | out: lpCommandLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe", lpProcessInformation=0x2679f98*(hProcess=0x8060, hThread=0xa360, dwProcessId=0xff4, dwThreadId=0x514)) returned 1 [0067.355] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0067.356] GetProcAddress (hModule=0x76750000, lpProcName="GetThreadContext") returned 0x76765580 [0067.435] GetThreadContext (in: hThread=0xa360, lpContext=0x267a2dc | out: lpContext=0x267a2dc*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x250000, Edx=0x0, Ecx=0x0, Eax=0x404d61, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0067.435] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0067.435] GetProcAddress (hModule=0x76750000, lpProcName="ReadProcessMemory") returned 0x76765e30 [0067.445] LoadLibraryA (lpLibFileName="ntdll") returned 0x77850000 [0067.445] GetProcAddress (hModule=0x77850000, lpProcName="NtUnmapViewOfSection") returned 0x778c1fb0 [0067.452] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0067.452] GetProcAddress (hModule=0x76750000, lpProcName="VirtualAllocEx") returned 0x76766990 [0067.458] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0067.458] GetProcAddress (hModule=0x76750000, lpProcName="WriteProcessMemory") returned 0x76766b70 [0067.528] WriteProcessMemory (in: hProcess=0x8060, lpBaseAddress=0x401000, lpBuffer=0x267b648*, nSize=0x0, lpNumberOfBytesWritten=0x53eee0 | out: lpBuffer=0x267b648*, lpNumberOfBytesWritten=0x53eee0*=0x0) returned 1 [0067.528] WriteProcessMemory (in: hProcess=0x8060, lpBaseAddress=0x413000, lpBuffer=0x267b66c*, nSize=0x7a00, lpNumberOfBytesWritten=0x53eee0 | out: lpBuffer=0x267b66c*, lpNumberOfBytesWritten=0x53eee0*=0x7a00) returned 1 [0067.529] WriteProcessMemory (in: hProcess=0x8060, lpBaseAddress=0x41b000, lpBuffer=0x2683090*, nSize=0xc00, lpNumberOfBytesWritten=0x53eee0 | out: lpBuffer=0x2683090*, lpNumberOfBytesWritten=0x53eee0*=0xc00) returned 1 [0067.627] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.627] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.627] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.627] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.627] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.627] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.628] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.629] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.630] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.631] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.632] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x0 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x1 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] VarDecCmp (pdecLeft=0x53ea68, pdecRight=0x53ea58) returned 0x2 [0067.633] WriteProcessMemory (in: hProcess=0x8060, lpBaseAddress=0x250008, lpBuffer=0x2683cb4*, nSize=0x4, lpNumberOfBytesWritten=0x53eee0 | out: lpBuffer=0x2683cb4*, lpNumberOfBytesWritten=0x53eee0*=0x4) returned 1 [0067.634] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0067.634] GetProcAddress (hModule=0x76750000, lpProcName="SetThreadContext") returned 0x767666a0 [0067.634] SetThreadContext (hThread=0xa360, lpContext=0x267a2dc*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x250000, Edx=0x0, Ecx=0x0, Eax=0x41a7c0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0067.775] LoadLibraryA (lpLibFileName="kernel32") returned 0x76750000 [0067.776] GetProcAddress (hModule=0x76750000, lpProcName="ResumeThread") returned 0x76766380 [0067.796] ResumeThread (hThread=0xa360) returned 0x1 [0067.836] CoGetContextToken (in: pToken=0x53fa14 | out: pToken=0x53fa14) returned 0x0 [0067.836] CObjectContext::QueryInterface () returned 0x0 [0067.836] CObjectContext::GetCurrentThreadType () returned 0x0 [0067.836] Release () returned 0x0 [0067.837] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x720938*=0x188, lpdwindex=0x53f880 | out: lpdwindex=0x53f880) returned 0x0 Thread: id = 2 os_tid = 0x13ec Thread: id = 3 os_tid = 0x1064 Thread: id = 4 os_tid = 0x1060 [0056.993] CoGetContextToken (in: pToken=0x47ef428 | out: pToken=0x47ef428) returned 0x800401f0 [0056.993] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0059.108] CloseHandle (hObject=0x5e18) returned 1 [0059.108] GetLastError () returned 0x0 [0059.109] CloseHandle (hObject=0x8b9c) returned 1 [0059.109] GetLastError () returned 0x0 [0059.109] CloseHandle (hObject=0x5e14) returned 1 [0059.109] GetLastError () returned 0x0 [0059.109] CloseHandle (hObject=0xa260) returned 1 [0059.109] GetLastError () returned 0x0 [0059.109] CloseHandle (hObject=0x5e10) returned 1 [0059.109] GetLastError () returned 0x0 [0059.109] CloseHandle (hObject=0x8b98) returned 1 [0059.109] GetLastError () returned 0x0 [0059.110] CloseHandle (hObject=0x5e0c) returned 1 [0059.110] GetLastError () returned 0x0 [0059.110] CloseHandle (hObject=0xb64c) returned 1 [0059.110] GetLastError () returned 0x0 [0059.110] CloseHandle (hObject=0x5e08) returned 1 [0059.110] GetLastError () returned 0x0 [0059.110] CloseHandle (hObject=0x8b94) returned 1 [0059.110] GetLastError () returned 0x0 [0059.110] CloseHandle (hObject=0x5e04) returned 1 [0059.111] GetLastError () returned 0x0 [0059.111] CloseHandle (hObject=0xa25c) returned 1 [0059.111] GetLastError () returned 0x0 [0059.111] CloseHandle (hObject=0x5e00) returned 1 [0059.111] GetLastError () returned 0x0 [0059.111] CloseHandle (hObject=0x8b90) returned 1 [0059.111] GetLastError () returned 0x0 [0059.111] CloseHandle (hObject=0x5dfc) returned 1 [0059.111] GetLastError () returned 0x0 [0059.112] CloseHandle (hObject=0xadc0) returned 1 [0059.112] GetLastError () returned 0x0 [0059.112] CloseHandle (hObject=0x5df8) returned 1 [0059.112] GetLastError () returned 0x0 [0059.112] CloseHandle (hObject=0x8b8c) returned 1 [0059.112] GetLastError () returned 0x0 [0059.112] CloseHandle (hObject=0x5df4) returned 1 [0059.112] GetLastError () returned 0x0 [0059.113] CloseHandle (hObject=0xa258) returned 1 [0059.113] GetLastError () returned 0x0 [0059.113] CloseHandle (hObject=0x5df0) returned 1 [0059.113] GetLastError () returned 0x0 [0059.113] CloseHandle (hObject=0x8b88) returned 1 [0059.113] GetLastError () returned 0x0 [0059.113] CloseHandle (hObject=0x5dec) returned 1 [0059.113] GetLastError () returned 0x0 [0059.114] CloseHandle (hObject=0xb370) returned 1 [0059.114] GetLastError () returned 0x0 [0059.114] CloseHandle (hObject=0x5de8) returned 1 [0059.114] GetLastError () returned 0x0 [0059.114] CloseHandle (hObject=0x8b84) returned 1 [0059.114] GetLastError () returned 0x0 [0059.114] CloseHandle (hObject=0x5de4) returned 1 [0059.114] GetLastError () returned 0x0 [0059.114] CloseHandle (hObject=0xa254) returned 1 [0059.114] GetLastError () returned 0x0 [0059.114] CloseHandle (hObject=0x5de0) returned 1 [0059.115] GetLastError () returned 0x0 [0059.115] CloseHandle (hObject=0x8b80) returned 1 [0059.115] GetLastError () returned 0x0 [0059.115] CloseHandle (hObject=0x5ddc) returned 1 [0059.115] GetLastError () returned 0x0 [0059.115] CloseHandle (hObject=0xadbc) returned 1 [0059.115] GetLastError () returned 0x0 [0059.115] CloseHandle (hObject=0x5dd8) returned 1 [0059.115] GetLastError () returned 0x0 [0059.115] CloseHandle (hObject=0x8b7c) returned 1 [0059.115] GetLastError () returned 0x0 [0059.116] CloseHandle (hObject=0x5dd4) returned 1 [0059.116] GetLastError () returned 0x0 [0059.116] CloseHandle (hObject=0xa250) returned 1 [0059.116] GetLastError () returned 0x0 [0059.116] CloseHandle (hObject=0x5dd0) returned 1 [0059.116] GetLastError () returned 0x0 [0059.116] CloseHandle (hObject=0x8b78) returned 1 [0059.116] GetLastError () returned 0x0 [0059.116] CloseHandle (hObject=0x5dcc) returned 1 [0059.116] GetLastError () returned 0x0 [0059.116] CloseHandle (hObject=0xb870) returned 1 [0059.116] GetLastError () returned 0x0 [0059.117] CloseHandle (hObject=0x5dc8) returned 1 [0059.117] GetLastError () returned 0x0 [0059.117] CloseHandle (hObject=0x8b74) returned 1 [0059.117] GetLastError () returned 0x0 [0059.117] CloseHandle (hObject=0x5dc4) returned 1 [0059.117] GetLastError () returned 0x0 [0059.117] CloseHandle (hObject=0xa24c) returned 1 [0059.117] GetLastError () returned 0x0 [0059.117] CloseHandle (hObject=0x5dc0) returned 1 [0059.117] GetLastError () returned 0x0 [0059.117] CloseHandle (hObject=0x8b70) returned 1 [0059.117] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0x5dbc) returned 1 [0059.118] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0xadb8) returned 1 [0059.118] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0x5db8) returned 1 [0059.118] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0x8b6c) returned 1 [0059.118] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0x5db4) returned 1 [0059.118] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0xa248) returned 1 [0059.118] GetLastError () returned 0x0 [0059.118] CloseHandle (hObject=0x5db0) returned 1 [0059.119] GetLastError () returned 0x0 [0059.119] CloseHandle (hObject=0x8b68) returned 1 [0059.119] GetLastError () returned 0x0 [0059.119] CloseHandle (hObject=0x5dac) returned 1 [0059.119] GetLastError () returned 0x0 [0059.119] CloseHandle (hObject=0xb36c) returned 1 [0059.119] GetLastError () returned 0x0 [0059.119] CloseHandle (hObject=0x5da8) returned 1 [0059.119] GetLastError () returned 0x0 [0059.119] CloseHandle (hObject=0x8b64) returned 1 [0059.119] GetLastError () returned 0x0 [0059.119] CloseHandle (hObject=0x5da4) returned 1 [0059.119] GetLastError () returned 0x0 [0059.120] CloseHandle (hObject=0xa244) returned 1 [0059.120] GetLastError () returned 0x0 [0059.120] CloseHandle (hObject=0x5da0) returned 1 [0059.120] GetLastError () returned 0x0 [0059.120] CloseHandle (hObject=0x8b60) returned 1 [0059.120] GetLastError () returned 0x0 [0059.120] CloseHandle (hObject=0x5d9c) returned 1 [0059.120] GetLastError () returned 0x0 [0059.121] CloseHandle (hObject=0xadb4) returned 1 [0059.121] GetLastError () returned 0x0 [0059.121] CloseHandle (hObject=0x5d98) returned 1 [0059.121] GetLastError () returned 0x0 [0059.121] CloseHandle (hObject=0x8b5c) returned 1 [0059.121] GetLastError () returned 0x0 [0059.121] CloseHandle (hObject=0x5d94) returned 1 [0059.121] GetLastError () returned 0x0 [0059.121] CloseHandle (hObject=0xa240) returned 1 [0059.121] GetLastError () returned 0x0 [0059.121] CloseHandle (hObject=0x5d90) returned 1 [0059.121] GetLastError () returned 0x0 [0059.122] CloseHandle (hObject=0x8b58) returned 1 [0059.122] GetLastError () returned 0x0 [0059.122] CloseHandle (hObject=0x5d8c) returned 1 [0059.122] GetLastError () returned 0x0 [0059.122] CloseHandle (hObject=0xb648) returned 1 [0059.122] GetLastError () returned 0x0 [0059.122] CloseHandle (hObject=0x5d88) returned 1 [0059.122] GetLastError () returned 0x0 [0059.122] CloseHandle (hObject=0x8b54) returned 1 [0059.122] GetLastError () returned 0x0 [0059.122] CloseHandle (hObject=0x5d84) returned 1 [0059.122] GetLastError () returned 0x0 [0059.123] CloseHandle (hObject=0xa23c) returned 1 [0059.123] GetLastError () returned 0x0 [0059.123] CloseHandle (hObject=0x5d80) returned 1 [0059.123] GetLastError () returned 0x0 [0059.123] CloseHandle (hObject=0x8b50) returned 1 [0059.123] GetLastError () returned 0x0 [0059.123] CloseHandle (hObject=0x5d7c) returned 1 [0059.123] GetLastError () returned 0x0 [0059.123] CloseHandle (hObject=0xadb0) returned 1 [0059.123] GetLastError () returned 0x0 [0059.123] CloseHandle (hObject=0x5d78) returned 1 [0059.123] GetLastError () returned 0x0 [0059.124] CloseHandle (hObject=0x8b4c) returned 1 [0059.124] GetLastError () returned 0x0 [0059.124] CloseHandle (hObject=0x5d74) returned 1 [0059.124] GetLastError () returned 0x0 [0059.124] CloseHandle (hObject=0xa238) returned 1 [0059.124] GetLastError () returned 0x0 [0059.124] CloseHandle (hObject=0x5d70) returned 1 [0059.124] GetLastError () returned 0x0 [0059.124] CloseHandle (hObject=0x8b48) returned 1 [0059.125] GetLastError () returned 0x0 [0059.125] CloseHandle (hObject=0x5d6c) returned 1 [0059.125] GetLastError () returned 0x0 [0059.125] CloseHandle (hObject=0xb368) returned 1 [0059.125] GetLastError () returned 0x0 [0059.125] CloseHandle (hObject=0x5d68) returned 1 [0059.125] GetLastError () returned 0x0 [0059.126] CloseHandle (hObject=0x8b44) returned 1 [0059.126] GetLastError () returned 0x0 [0059.126] CloseHandle (hObject=0x5d64) returned 1 [0059.126] GetLastError () returned 0x0 [0059.126] CloseHandle (hObject=0xa234) returned 1 [0059.126] GetLastError () returned 0x0 [0059.126] CloseHandle (hObject=0x5d60) returned 1 [0059.127] GetLastError () returned 0x0 [0059.127] CloseHandle (hObject=0x8b40) returned 1 [0059.127] GetLastError () returned 0x0 [0059.127] CloseHandle (hObject=0x5d5c) returned 1 [0059.127] GetLastError () returned 0x0 [0059.127] CloseHandle (hObject=0xadac) returned 1 [0059.127] GetLastError () returned 0x0 [0059.127] CloseHandle (hObject=0x5d58) returned 1 [0059.127] GetLastError () returned 0x0 [0059.128] CloseHandle (hObject=0x8b3c) returned 1 [0059.128] GetLastError () returned 0x0 [0059.128] CloseHandle (hObject=0x5d54) returned 1 [0059.128] GetLastError () returned 0x0 [0059.128] CloseHandle (hObject=0xa230) returned 1 [0059.128] GetLastError () returned 0x0 [0059.128] CloseHandle (hObject=0x5d50) returned 1 [0059.128] GetLastError () returned 0x0 [0059.129] CloseHandle (hObject=0x8b38) returned 1 [0059.129] GetLastError () returned 0x0 [0059.129] CloseHandle (hObject=0x5d4c) returned 1 [0059.129] GetLastError () returned 0x0 [0059.129] CloseHandle (hObject=0xb7b4) returned 1 [0059.129] GetLastError () returned 0x0 [0059.129] CloseHandle (hObject=0x5d48) returned 1 [0059.129] GetLastError () returned 0x0 [0059.129] CloseHandle (hObject=0x8b34) returned 1 [0059.130] GetLastError () returned 0x0 [0059.130] CloseHandle (hObject=0x5d44) returned 1 [0059.130] GetLastError () returned 0x0 [0059.130] CloseHandle (hObject=0xa22c) returned 1 [0059.130] GetLastError () returned 0x0 [0059.130] CloseHandle (hObject=0x5d40) returned 1 [0059.130] GetLastError () returned 0x0 [0059.130] CloseHandle (hObject=0x8b30) returned 1 [0059.130] GetLastError () returned 0x0 [0059.131] CloseHandle (hObject=0x5d3c) returned 1 [0059.131] GetLastError () returned 0x0 [0059.131] CloseHandle (hObject=0xada8) returned 1 [0059.131] GetLastError () returned 0x0 [0059.131] CloseHandle (hObject=0x5d38) returned 1 [0059.131] GetLastError () returned 0x0 [0059.131] CloseHandle (hObject=0x8b2c) returned 1 [0059.132] GetLastError () returned 0x0 [0059.132] CloseHandle (hObject=0x5d34) returned 1 [0059.132] GetLastError () returned 0x0 [0059.132] CloseHandle (hObject=0xa228) returned 1 [0059.132] GetLastError () returned 0x0 [0059.132] CloseHandle (hObject=0x5d30) returned 1 [0059.132] GetLastError () returned 0x0 [0059.133] CloseHandle (hObject=0x8b28) returned 1 [0059.133] GetLastError () returned 0x0 [0059.133] CloseHandle (hObject=0x5d2c) returned 1 [0059.133] GetLastError () returned 0x0 [0059.133] CloseHandle (hObject=0xb364) returned 1 [0059.133] GetLastError () returned 0x0 [0059.133] CloseHandle (hObject=0x5d28) returned 1 [0059.134] GetLastError () returned 0x0 [0059.134] CloseHandle (hObject=0x8b24) returned 1 [0059.134] GetLastError () returned 0x0 [0059.134] CloseHandle (hObject=0x5d24) returned 1 [0059.134] GetLastError () returned 0x0 [0059.134] CloseHandle (hObject=0xa224) returned 1 [0059.134] GetLastError () returned 0x0 [0059.996] CloseHandle (hObject=0x12fc) returned 1 [0060.007] GetLastError () returned 0x0 [0060.015] CloseHandle (hObject=0x36b8) returned 1 [0060.015] GetLastError () returned 0x0 [0060.015] CloseHandle (hObject=0xb04) returned 1 [0060.015] GetLastError () returned 0x0 [0060.015] CloseHandle (hObject=0x7870) returned 1 [0060.015] GetLastError () returned 0x0 [0060.015] CloseHandle (hObject=0x5404) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0xf00) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0x6214) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0x823c) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0x980c) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0x8a8c) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0xb00) returned 1 [0060.016] GetLastError () returned 0x0 [0060.016] CloseHandle (hObject=0x1100) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0x4994) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0x6414) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0x8d9c) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0xb880) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0x34b8) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0x77ec) returned 1 [0060.017] GetLastError () returned 0x0 [0060.017] CloseHandle (hObject=0xafc) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0x821c) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0x8a7c) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0xefc) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0x6210) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0xb688) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0x76ec) returned 1 [0060.018] GetLastError () returned 0x0 [0060.018] CloseHandle (hObject=0x81dc) returned 1 [0060.019] GetLastError () returned 0x0 [0060.019] CloseHandle (hObject=0xaf8) returned 1 [0060.019] GetLastError () returned 0x0 [0060.019] CloseHandle (hObject=0xb684) returned 1 [0060.019] GetLastError () returned 0x0 [0060.019] CloseHandle (hObject=0x815c) returned 1 [0060.019] GetLastError () returned 0x0 [0060.019] CloseHandle (hObject=0xb67c) returned 1 [0060.019] GetLastError () returned 0x0 [0060.019] CloseHandle (hObject=0xb66c) returned 1 [0060.019] GetLastError () returned 0x0 [0060.020] CloseHandle (hObject=0x34b4) returned 1 [0060.020] GetLastError () returned 0x0 [0060.020] CloseHandle (hObject=0x36b4) returned 1 [0060.020] GetLastError () returned 0x0 [0060.020] CloseHandle (hObject=0xaf4) returned 1 [0060.020] GetLastError () returned 0x0 [0060.020] CloseHandle (hObject=0x37b4) returned 1 [0060.020] GetLastError () returned 0x0 [0060.020] CloseHandle (hObject=0xb5fc) returned 1 [0060.020] GetLastError () returned 0x0 [0060.020] CloseHandle (hObject=0xef8) returned 1 [0060.020] GetLastError () returned 0x0 [0060.021] CloseHandle (hObject=0x620c) returned 1 [0060.021] GetLastError () returned 0x0 [0060.021] CloseHandle (hObject=0x3838) returned 1 [0060.021] GetLastError () returned 0x0 [0060.021] CloseHandle (hObject=0xa898) returned 1 [0060.021] GetLastError () returned 0x0 [0060.021] CloseHandle (hObject=0xb600) returned 1 [0060.021] GetLastError () returned 0x0 [0060.021] CloseHandle (hObject=0xaf0) returned 1 [0060.021] GetLastError () returned 0x0 [0060.021] CloseHandle (hObject=0x10fc) returned 1 [0060.021] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0x4990) returned 1 [0060.022] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0x6410) returned 1 [0060.022] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0x8d98) returned 1 [0060.022] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0x3878) returned 1 [0060.022] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0x34b0) returned 1 [0060.022] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0xa8d8) returned 1 [0060.022] GetLastError () returned 0x0 [0060.022] CloseHandle (hObject=0xaec) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CloseHandle (hObject=0xb8f4) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CloseHandle (hObject=0x5938) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CloseHandle (hObject=0xef4) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CloseHandle (hObject=0x6208) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CloseHandle (hObject=0x11fc) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CloseHandle (hObject=0x76e8) returned 1 [0060.023] GetLastError () returned 0x0 [0060.024] CloseHandle (hObject=0x4a90) returned 1 [0060.024] GetLastError () returned 0x0 [0060.024] CloseHandle (hObject=0xae8) returned 1 [0060.024] GetLastError () returned 0x0 [0060.024] CloseHandle (hObject=0x6510) returned 1 [0060.024] GetLastError () returned 0x0 [0060.024] CloseHandle (hObject=0x9d40) returned 1 [0060.024] GetLastError () returned 0x0 [0060.024] CloseHandle (hObject=0x8e98) returned 1 [0060.024] GetLastError () returned 0x0 [0060.024] CloseHandle (hObject=0xa35c) returned 1 [0060.024] GetLastError () returned 0x0 [0060.025] CloseHandle (hObject=0x3898) returned 1 [0060.025] GetLastError () returned 0x0 [0060.025] CloseHandle (hObject=0x34ac) returned 1 [0060.025] GetLastError () returned 0x0 [0060.025] CloseHandle (hObject=0x36b0) returned 1 [0060.025] GetLastError () returned 0x0 [0060.025] CloseHandle (hObject=0xae4) returned 1 [0060.025] GetLastError () returned 0x0 [0060.025] CloseHandle (hObject=0xa8f8) returned 1 [0060.025] GetLastError () returned 0x0 [0060.025] CloseHandle (hObject=0x53fc) returned 1 [0060.025] GetLastError () returned 0x0 [0060.026] CloseHandle (hObject=0xef0) returned 1 [0060.026] GetLastError () returned 0x0 [0060.026] CloseHandle (hObject=0x6204) returned 1 [0060.026] GetLastError () returned 0x0 [0060.026] CloseHandle (hObject=0xb2e0) returned 1 [0060.026] GetLastError () returned 0x0 [0060.026] CloseHandle (hObject=0x9808) returned 1 [0060.026] GetLastError () returned 0x0 [0060.026] CloseHandle (hObject=0x5978) returned 1 [0060.026] GetLastError () returned 0x0 [0060.026] CloseHandle (hObject=0xae0) returned 1 [0060.026] GetLastError () returned 0x0 [0060.027] CloseHandle (hObject=0x10f8) returned 1 [0060.027] GetLastError () returned 0x0 [0060.027] CloseHandle (hObject=0x498c) returned 1 [0060.027] GetLastError () returned 0x0 [0060.027] CloseHandle (hObject=0x640c) returned 1 [0060.027] GetLastError () returned 0x0 [0060.027] CloseHandle (hObject=0x8d94) returned 1 [0060.027] GetLastError () returned 0x0 [0060.027] CloseHandle (hObject=0x127c) returned 1 [0060.027] GetLastError () returned 0x0 [0060.027] CloseHandle (hObject=0x34a8) returned 1 [0060.027] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0x77e8) returned 1 [0060.028] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0xadc) returned 1 [0060.028] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0x4b10) returned 1 [0060.028] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0xa224) returned 1 [0060.028] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0xeec) returned 1 [0060.028] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0x6200) returned 1 [0060.028] GetLastError () returned 0x0 [0060.028] CloseHandle (hObject=0x6590) returned 1 [0060.029] GetLastError () returned 0x0 [0060.029] CloseHandle (hObject=0x76e4) returned 1 [0060.029] GetLastError () returned 0x0 [0060.029] CloseHandle (hObject=0x9d80) returned 1 [0060.029] GetLastError () returned 0x0 [0060.029] CloseHandle (hObject=0xad8) returned 1 [0060.029] GetLastError () returned 0x0 [0060.029] CloseHandle (hObject=0x8f18) returned 1 [0060.029] GetLastError () returned 0x0 [0060.029] CloseHandle (hObject=0x8158) returned 1 [0060.029] GetLastError () returned 0x0 [0060.030] CloseHandle (hObject=0xa3dc) returned 1 [0060.030] GetLastError () returned 0x0 [0060.030] CloseHandle (hObject=0xae40) returned 1 [0060.030] GetLastError () returned 0x0 [0060.030] CloseHandle (hObject=0x38a8) returned 1 [0060.030] GetLastError () returned 0x0 [0060.030] CloseHandle (hObject=0x34a4) returned 1 [0060.030] GetLastError () returned 0x0 [0060.030] CloseHandle (hObject=0x36ac) returned 1 [0060.030] GetLastError () returned 0x0 [0060.030] CloseHandle (hObject=0xad4) returned 1 [0060.030] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0x37b0) returned 1 [0060.031] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0x8690) returned 1 [0060.031] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0xee8) returned 1 [0060.031] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0x61fc) returned 1 [0060.031] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0xa908) returned 1 [0060.031] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0xb8e4) returned 1 [0060.031] GetLastError () returned 0x0 [0060.031] CloseHandle (hObject=0x5480) returned 1 [0060.031] GetLastError () returned 0x0 [0060.032] CloseHandle (hObject=0xad0) returned 1 [0060.032] GetLastError () returned 0x0 [0060.032] CloseHandle (hObject=0x10f4) returned 1 [0060.032] GetLastError () returned 0x0 [0060.032] CloseHandle (hObject=0x4988) returned 1 [0060.032] GetLastError () returned 0x0 [0060.032] CloseHandle (hObject=0x6408) returned 1 [0060.032] GetLastError () returned 0x0 [0060.032] CloseHandle (hObject=0x8d90) returned 1 [0060.032] GetLastError () returned 0x0 [0060.032] CloseHandle (hObject=0xaca0) returned 1 [0060.032] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0x34a0) returned 1 [0060.033] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0x9888) returned 1 [0060.033] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0xacc) returned 1 [0060.033] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0x5998) returned 1 [0060.033] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0xad28) returned 1 [0060.033] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0xee4) returned 1 [0060.033] GetLastError () returned 0x0 [0060.033] CloseHandle (hObject=0x61f8) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CloseHandle (hObject=0x11f8) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CloseHandle (hObject=0x76e0) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CloseHandle (hObject=0x4a8c) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CloseHandle (hObject=0xac8) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CloseHandle (hObject=0x650c) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CloseHandle (hObject=0xab30) returned 1 [0060.034] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0x8e94) returned 1 [0060.035] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0xa358) returned 1 [0060.035] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0x12bc) returned 1 [0060.035] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0x349c) returned 1 [0060.035] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0x36a8) returned 1 [0060.035] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0xac4) returned 1 [0060.035] GetLastError () returned 0x0 [0060.035] CloseHandle (hObject=0x786c) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0x53f8) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0xee0) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0x61f4) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0x4b50) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0x9804) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0xa228) returned 1 [0060.036] GetLastError () returned 0x0 [0060.036] CloseHandle (hObject=0xac0) returned 1 [0060.037] GetLastError () returned 0x0 [0060.037] CloseHandle (hObject=0x10f0) returned 1 [0060.037] GetLastError () returned 0x0 [0060.037] CloseHandle (hObject=0x4984) returned 1 [0060.037] GetLastError () returned 0x0 [0060.037] CloseHandle (hObject=0x6404) returned 1 [0060.037] GetLastError () returned 0x0 [0060.037] CloseHandle (hObject=0x8d8c) returned 1 [0060.037] GetLastError () returned 0x0 [0060.037] CloseHandle (hObject=0x65d0) returned 1 [0060.037] GetLastError () returned 0x0 [0060.037] CloseHandle (hObject=0x3498) returned 1 [0060.037] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0x77e4) returned 1 [0060.038] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0xabc) returned 1 [0060.038] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0x9da0) returned 1 [0060.038] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0x5bd0) returned 1 [0060.038] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0xedc) returned 1 [0060.038] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0x61f0) returned 1 [0060.038] GetLastError () returned 0x0 [0060.038] CloseHandle (hObject=0x8f58) returned 1 [0060.038] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0x76dc) returned 1 [0060.039] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0x81d8) returned 1 [0060.039] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0xab8) returned 1 [0060.039] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0xa420) returned 1 [0060.039] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0x8154) returned 1 [0060.039] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0xae80) returned 1 [0060.039] GetLastError () returned 0x0 [0060.039] CloseHandle (hObject=0xb3b0) returned 1 [0060.039] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0x38b0) returned 1 [0060.040] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0x3494) returned 1 [0060.040] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0x36a4) returned 1 [0060.040] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0xab4) returned 1 [0060.040] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0x37ac) returned 1 [0060.040] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0x9fd8) returned 1 [0060.040] GetLastError () returned 0x0 [0060.040] CloseHandle (hObject=0xed8) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0x61ec) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0x3834) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0xa894) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0x86d0) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0xab0) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0x10ec) returned 1 [0060.041] GetLastError () returned 0x0 [0060.041] CloseHandle (hObject=0x4980) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0x63fc) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0x8d88) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0xa910) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0x3490) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0xb8a4) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0xaac) returned 1 [0060.042] GetLastError () returned 0x0 [0060.042] CloseHandle (hObject=0x54c0) returned 1 [0060.043] GetLastError () returned 0x0 [0060.043] CloseHandle (hObject=0x5934) returned 1 [0060.043] GetLastError () returned 0x0 [0060.043] CloseHandle (hObject=0xed4) returned 1 [0060.043] GetLastError () returned 0x0 [0060.043] CloseHandle (hObject=0x61e8) returned 1 [0060.043] GetLastError () returned 0x0 [0060.043] CloseHandle (hObject=0x11f4) returned 1 [0060.043] GetLastError () returned 0x0 [0060.043] CloseHandle (hObject=0x76d8) returned 1 [0060.043] GetLastError () returned 0x0 [0060.043] CloseHandle (hObject=0x4a88) returned 1 [0060.043] GetLastError () returned 0x0 [0060.044] CloseHandle (hObject=0xaa8) returned 1 [0060.044] GetLastError () returned 0x0 [0060.044] CloseHandle (hObject=0x6508) returned 1 [0060.044] GetLastError () returned 0x0 [0060.044] CloseHandle (hObject=0x9d3c) returned 1 [0060.044] GetLastError () returned 0x0 [0060.044] CloseHandle (hObject=0x8e90) returned 1 [0060.044] GetLastError () returned 0x0 [0060.044] CloseHandle (hObject=0xa354) returned 1 [0060.044] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0xa01c) returned 1 [0060.045] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0x348c) returned 1 [0060.045] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0x36a0) returned 1 [0060.045] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0xaa4) returned 1 [0060.045] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0x98c8) returned 1 [0060.045] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0x53f4) returned 1 [0060.045] GetLastError () returned 0x0 [0060.045] CloseHandle (hObject=0xed0) returned 1 [0060.045] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0x61e4) returned 1 [0060.046] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0x59a8) returned 1 [0060.046] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0x97fc) returned 1 [0060.046] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0xad30) returned 1 [0060.046] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0xaa0) returned 1 [0060.046] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0x10e8) returned 1 [0060.046] GetLastError () returned 0x0 [0060.046] CloseHandle (hObject=0x497c) returned 1 [0060.046] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0x63f8) returned 1 [0060.047] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0x8d84) returned 1 [0060.047] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0x1278) returned 1 [0060.047] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0x3488) returned 1 [0060.047] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0x77e0) returned 1 [0060.047] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0xa9c) returned 1 [0060.047] GetLastError () returned 0x0 [0060.047] CloseHandle (hObject=0x4b0c) returned 1 [0060.048] GetLastError () returned 0x0 [0060.048] CloseHandle (hObject=0x5dc8) returned 1 [0060.048] GetLastError () returned 0x0 [0060.048] CloseHandle (hObject=0xecc) returned 1 [0060.048] GetLastError () returned 0x0 [0060.048] CloseHandle (hObject=0x61e0) returned 1 [0060.048] GetLastError () returned 0x0 [0060.048] CloseHandle (hObject=0x658c) returned 1 [0060.048] GetLastError () returned 0x0 [0060.048] CloseHandle (hObject=0x76d4) returned 1 [0060.048] GetLastError () returned 0x0 [0060.048] CloseHandle (hObject=0xab50) returned 1 [0060.048] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0xa98) returned 1 [0060.049] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0x8f14) returned 1 [0060.049] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0x8150) returned 1 [0060.049] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0xa3d8) returned 1 [0060.049] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0xae3c) returned 1 [0060.049] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0x12dc) returned 1 [0060.049] GetLastError () returned 0x0 [0060.049] CloseHandle (hObject=0x3484) returned 1 [0060.049] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0x369c) returned 1 [0060.050] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0xa94) returned 1 [0060.050] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0x37a8) returned 1 [0060.050] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0x868c) returned 1 [0060.050] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0xec8) returned 1 [0060.050] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0x61dc) returned 1 [0060.050] GetLastError () returned 0x0 [0060.050] CloseHandle (hObject=0x78ac) returned 1 [0060.050] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0xb0dc) returned 1 [0060.051] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0x547c) returned 1 [0060.051] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0xa90) returned 1 [0060.051] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0x10e4) returned 1 [0060.051] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0x4978) returned 1 [0060.051] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0x63f4) returned 1 [0060.051] GetLastError () returned 0x0 [0060.051] CloseHandle (hObject=0x8d80) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0x4b70) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0x3480) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0x9884) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0xa8c) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0xada8) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0x892c) returned 1 [0060.052] GetLastError () returned 0x0 [0060.052] CloseHandle (hObject=0xec4) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0x61d8) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0x11f0) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0x76d0) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0x4a84) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0xa88) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0x6504) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0xb5a8) returned 1 [0060.053] GetLastError () returned 0x0 [0060.053] CloseHandle (hObject=0x8e8c) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0xa350) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0x65f0) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0x347c) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0x3698) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0xa84) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0x7868) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0x53f0) returned 1 [0060.054] GetLastError () returned 0x0 [0060.054] CloseHandle (hObject=0xec0) returned 1 [0060.054] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x61d4) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x9db0) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x97f8) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x5bf0) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0xa80) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x10e0) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x4974) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x63f0) returned 1 [0060.055] GetLastError () returned 0x0 [0060.055] CloseHandle (hObject=0x8d7c) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0x8f78) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0x3478) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0x77dc) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0xa7c) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0x8218) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0xa1d0) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0xebc) returned 1 [0060.056] GetLastError () returned 0x0 [0060.056] CloseHandle (hObject=0x61d0) returned 1 [0060.056] GetLastError () returned 0x0 [0060.057] CloseHandle (hObject=0xa440) returned 1 [0060.057] GetLastError () returned 0x0 [0060.057] CloseHandle (hObject=0x76cc) returned 1 [0060.057] GetLastError () returned 0x0 Thread: id = 6 os_tid = 0x4f4 Thread: id = 8 os_tid = 0x500 Thread: id = 9 os_tid = 0x518 Thread: id = 10 os_tid = 0x438 Process: id = "2" image_name = "cvtres.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe" page_root = "0xfe1c000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13cc" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x514 [0068.371] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76750000 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="WriteFile") returned 0x767bf180 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="SetFilePointer") returned 0x767bf120 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="SetEndOfFile") returned 0x767bf0e0 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="ReadFile") returned 0x767bf090 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="MoveFileA") returned 0x7679e410 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="LockResource") returned 0x76765bc0 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="LoadResource") returned 0x76765b00 [0068.373] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleFileNameA") returned 0x76765070 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="GetFileSize") returned 0x767bef30 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="GetFileAttributesA") returned 0x767beee0 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="GetCommandLineA") returned 0x76764cb0 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="FreeResource") returned 0x76764c80 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="FreeLibrary") returned 0x76764c40 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="FindResourceA") returned 0x767a27c0 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="FindNextFileA") returned 0x767bee20 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="FindFirstFileA") returned 0x767bedb0 [0068.374] GetProcAddress (hModule=0x76750000, lpProcName="FindClose") returned 0x767bed70 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="DeleteFileA") returned 0x767bed30 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="CreateFileA") returned 0x767bed00 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="CloseHandle") returned 0x767beab0 [0068.375] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76750000 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="TlsSetValue") returned 0x76766870 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="TlsGetValue") returned 0x76766850 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="LocalAlloc") returned 0x76765b20 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleHandleA") returned 0x767650b0 [0068.375] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleFileNameA") returned 0x76765070 [0068.376] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76750000 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="GetCurrentThreadId") returned 0x76768820 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="DeleteCriticalSection") returned 0x7787fb90 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="LeaveCriticalSection") returned 0x7789b250 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="EnterCriticalSection") returned 0x7789b2d0 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="InitializeCriticalSection") returned 0x778aaf20 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="VirtualFree") returned 0x767669d0 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="VirtualAlloc") returned 0x76766970 [0068.376] GetProcAddress (hModule=0x76750000, lpProcName="LocalFree") returned 0x76765b40 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="LocalAlloc") returned 0x76765b20 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="VirtualQuery") returned 0x76766a70 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="lstrlenA") returned 0x76766c50 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="lstrcpyA") returned 0x767a7060 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="LoadLibraryExA") returned 0x76765aa0 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="GetThreadLocale") returned 0x76765600 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="GetStartupInfoA") returned 0x767a28e0 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleFileNameA") returned 0x76765070 [0068.377] GetProcAddress (hModule=0x76750000, lpProcName="GetLocaleInfoA") returned 0x76765020 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="GetLastError") returned 0x76765010 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="GetCommandLineA") returned 0x76764cb0 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="FreeLibrary") returned 0x76764c40 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="ExitProcess") returned 0x76763cb0 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="WriteFile") returned 0x767bf180 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="SetFilePointer") returned 0x767bf120 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="SetEndOfFile") returned 0x767bf0e0 [0068.378] GetProcAddress (hModule=0x76750000, lpProcName="RtlUnwind") returned 0x76767c10 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="ReadFile") returned 0x767bf090 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="RaiseException") returned 0x76765e20 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="GetStdHandle") returned 0x76765330 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="GetFileSize") returned 0x767bef30 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="GetSystemTime") returned 0x767654e0 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="GetFileType") returned 0x767bef60 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="CreateFileA") returned 0x767bed00 [0068.379] GetProcAddress (hModule=0x76750000, lpProcName="CloseHandle") returned 0x767beab0 [0068.379] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76390000 [0068.379] GetProcAddress (hModule=0x76390000, lpProcName="RegQueryValueExA") returned 0x763af020 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegOpenKeyExA") returned 0x763af210 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegFlushKey") returned 0x763b21b0 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegCreateKeyExA") returned 0x763af560 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegCloseKey") returned 0x763aed60 [0068.380] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76390000 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegQueryValueExA") returned 0x763af020 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegOpenKeyExA") returned 0x763af210 [0068.380] GetProcAddress (hModule=0x76390000, lpProcName="RegCloseKey") returned 0x763aed60 [0068.380] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76920000 [0068.381] GetProcAddress (hModule=0x76920000, lpProcName="DeleteObject") returned 0x769252b0 [0068.381] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76950000 [0068.381] GetProcAddress (hModule=0x76950000, lpProcName="VariantCopyInd") returned 0x76989dd0 [0068.381] GetProcAddress (hModule=0x76950000, lpProcName="VariantClear") returned 0x76989db0 [0068.381] GetProcAddress (hModule=0x76950000, lpProcName="SysFreeString") returned 0x7696b920 [0068.381] GetProcAddress (hModule=0x76950000, lpProcName="SysReAllocStringLen") returned 0x76971500 [0068.381] GetProcAddress (hModule=0x76950000, lpProcName="SysAllocStringLen") returned 0x7696b7e0 [0068.381] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74e50000 [0068.382] GetProcAddress (hModule=0x74e50000, lpProcName="SHFileOperationA") returned 0x75040a00 [0068.382] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76240000 [0068.382] GetProcAddress (hModule=0x76240000, lpProcName="TranslateMessage") returned 0x7626f900 [0068.382] GetProcAddress (hModule=0x76240000, lpProcName="ShowWindow") returned 0x76273ee0 [0068.382] GetProcAddress (hModule=0x76240000, lpProcName="SetWindowTextA") returned 0x7624e620 [0068.383] GetProcAddress (hModule=0x76240000, lpProcName="SetTimer") returned 0x76270370 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="SetPropA") returned 0x762614c0 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="SetFocus") returned 0x76273d10 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="SetCursor") returned 0x76272bec [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="SendMessageA") returned 0x76250630 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="RemovePropA") returned 0x76261780 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="RegisterClassA") returned 0x76257a10 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="PostQuitMessage") returned 0x76262bc0 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="PostMessageA") returned 0x7625b8d0 [0068.384] GetProcAddress (hModule=0x76240000, lpProcName="MessageBoxA") returned 0x762ad740 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="LoadIconA") returned 0x76262120 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="LoadCursorA") returned 0x7626ab70 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="KillTimer") returned 0x76273950 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="IsZoomed") returned 0x7625b000 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="IsWindowEnabled") returned 0x7625a220 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="IsWindow") returned 0x76267800 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="IsIconic") returned 0x7624ad50 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="InvalidateRect") returned 0x762738a0 [0068.385] GetProcAddress (hModule=0x76240000, lpProcName="GetSysColor") returned 0x7626fcf0 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="GetPropA") returned 0x7625d090 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="GetMessageA") returned 0x7625bdf0 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="GetKeyState") returned 0x7625a170 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="GetFocus") returned 0x7625d120 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="GetClassInfoA") returned 0x76257d70 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="GetCapture") returned 0x7625d1e0 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="DispatchMessageA") returned 0x7625fd80 [0068.386] GetProcAddress (hModule=0x76240000, lpProcName="DestroyWindow") returned 0x76273160 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="DestroyIcon") returned 0x76261810 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="DestroyAcceleratorTable") returned 0x7625d2a0 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="DefWindowProcA") returned 0x778d5680 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="CreateWindowExA") returned 0x76261470 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="CopyImage") returned 0x7625c330 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="CallWindowProcA") returned 0x7625a030 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="CharLowerA") returned 0x76262ef0 [0068.387] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76240000 [0068.387] GetProcAddress (hModule=0x76240000, lpProcName="GetKeyboardType") returned 0x762b8d80 [0068.388] GetProcAddress (hModule=0x76240000, lpProcName="MessageBoxA") returned 0x762ad740 [0068.388] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0068.388] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fe4c, nSize=0x105 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe")) returned 0x38 [0068.388] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19fd27, nSize=0x105 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe")) returned 0x38 [0068.388] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19fe3c | out: phkResult=0x19fe3c*=0x0) returned 0x2 [0068.388] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19fe3c | out: phkResult=0x19fe3c*=0x0) returned 0x2 [0068.388] lstrcpyA (in: lpString1=0x19fd27, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" [0068.388] GetThreadLocale () returned 0x409 [0068.388] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19fe37, cchData=5 | out: lpLCData="ENU") returned 4 [0068.390] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe") returned 56 [0068.390] lstrcpyA (in: lpString1=0x19fd5c, lpString2="ENU" | out: lpString1="ENU") returned="ENU" [0068.390] LoadLibraryExA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0068.390] lstrcpyA (in: lpString1=0x19fd5c, lpString2="EN" | out: lpString1="EN") returned="EN" [0068.390] LoadLibraryExA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0068.392] GetKeyboardType (nTypeFlag=0) returned 4 [0068.392] GetCommandLineA () returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" [0068.392] GetStartupInfoA (in: lpStartupInfo=0x19fee0 | out: lpStartupInfo=0x19fee0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0068.392] GetCurrentThreadId () returned 0x514 [0068.392] GetSystemTime (in: lpSystemTime=0x19ff1c | out: lpSystemTime=0x19ff1c*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x6, wDay=0xf, wHour=0x0, wMinute=0x28, wSecond=0x39, wMilliseconds=0x1a0)) [0068.392] GetCommandLineA () returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" [0068.392] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x7e5450 [0068.392] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x2070000 [0068.393] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x7e6450 [0068.393] VirtualAlloc (lpAddress=0x2070000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2070000 [0068.393] LoadIconA (hInstance=0x400000, lpIconName="ICON0") returned 0x1380127 [0068.479] FindResourceA (hModule=0x400000, lpName="Str1", lpType=0x64) returned 0x41b150 [0068.479] LoadResource (hModule=0x400000, hResInfo=0x41b150) returned 0x418c98 [0068.479] LockResource (hResData=0x418c98) returned 0x418c98 [0068.479] FreeResource (hResData=0x418c98) returned 0 [0068.479] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fe44 | out: phkResult=0x19fe44*=0x1bc) returned 0x0 [0068.480] RegQueryValueExA (in: hKey=0x1bc, lpValueName="Locale", lpReserved=0x0, lpType=0x19fe08, lpData=0x0, lpcbData=0x19fe24*=0x0 | out: lpType=0x19fe08*=0x1, lpData=0x0, lpcbData=0x19fe24*=0x9) returned 0x0 [0068.480] RegQueryValueExA (in: hKey=0x1bc, lpValueName="Locale", lpReserved=0x0, lpType=0x19fe20, lpData=0x2071784, lpcbData=0x19fe30*=0x9 | out: lpType=0x19fe20*=0x1, lpData="00000409", lpcbData=0x19fe30*=0x9) returned 0x0 [0068.480] RegCloseKey (hKey=0x1bc) returned 0x0 [0068.480] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fddc | out: phkResult=0x19fddc*=0x1bc) returned 0x0 [0068.480] RegQueryValueExA (in: hKey=0x1bc, lpValueName="Locale", lpReserved=0x0, lpType=0x19fda0, lpData=0x0, lpcbData=0x19fdbc*=0x0 | out: lpType=0x19fda0*=0x1, lpData=0x0, lpcbData=0x19fdbc*=0x9) returned 0x0 [0068.480] RegQueryValueExA (in: hKey=0x1bc, lpValueName="Locale", lpReserved=0x0, lpType=0x19fdb8, lpData=0x2071784, lpcbData=0x19fdc8*=0x9 | out: lpType=0x19fdb8*=0x1, lpData="00000409", lpcbData=0x19fdc8*=0x9) returned 0x0 [0068.480] RegCloseKey (hKey=0x1bc) returned 0x0 [0068.480] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fddc | out: phkResult=0x19fddc*=0x1bc) returned 0x0 [0068.480] RegQueryValueExA (in: hKey=0x1bc, lpValueName="Locale", lpReserved=0x0, lpType=0x19fda0, lpData=0x0, lpcbData=0x19fdbc*=0x0 | out: lpType=0x19fda0*=0x1, lpData=0x0, lpcbData=0x19fdbc*=0x9) returned 0x0 [0068.480] RegQueryValueExA (in: hKey=0x1bc, lpValueName="Locale", lpReserved=0x0, lpType=0x19fdb8, lpData=0x2071784, lpcbData=0x19fdc8*=0x9 | out: lpType=0x19fdb8*=0x1, lpData="00000409", lpcbData=0x19fdc8*=0x9) returned 0x0 [0068.480] RegCloseKey (hKey=0x1bc) returned 0x0 [0068.480] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0068.481] GetClassInfoA (in: hInstance=0x400000, lpClassName="", lpWndClass=0x19fe0c | out: lpWndClass=0x19fe0c) returned 0 [0068.481] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_", lpWndClass=0x19fd74 | out: lpWndClass=0x19fd74) returned 0 [0068.481] RegisterClassA (lpWndClass=0x19fe0c) returned 0xc194 [0068.481] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x201d2 [0069.206] SetPropA (hWnd=0x201d2, lpString="SELF_", hData=0x207177c) returned 1 [0069.207] NtdllDefWindowProc_A (hWnd=0x201d2, Msg=0x24, wParam=0x0, lParam=0x19f954) returned 0x0 [0069.207] GetPropA (hWnd=0x201d2, lpString="SELF_") returned 0x207177c [0069.207] NtdllDefWindowProc_A (hWnd=0x201d2, Msg=0x81, wParam=0x0, lParam=0x19f948) returned 0x1 [0069.214] GetPropA (hWnd=0x201d2, lpString="SELF_") returned 0x207177c [0069.214] NtdllDefWindowProc_A (hWnd=0x201d2, Msg=0x83, wParam=0x0, lParam=0x19f934) returned 0x0 [0069.545] GetPropA (hWnd=0x201d2, lpString="SELF_") returned 0x207177c [0069.545] NtdllDefWindowProc_A (hWnd=0x201d2, Msg=0x1, wParam=0x0, lParam=0x19f948) returned 0x0 [0069.548] SendMessageA (hWnd=0x201d2, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0069.548] GetPropA (hWnd=0x201d2, lpString="SELF_") returned 0x207177c [0069.548] NtdllDefWindowProc_A (hWnd=0x201d2, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0069.548] GetPropA (hWnd=0x201d2, lpString="SELF_") returned 0x207177c [0069.548] SetTimer (hWnd=0x201d2, nIDEvent=0x2070dc4, uElapse=0x3e8, lpTimerFunc=0x406ef4) returned 0x2070dc4 [0069.548] SetTimer (hWnd=0x201d2, nIDEvent=0x2070e28, uElapse=0x7d0, lpTimerFunc=0x406ef4) returned 0x2070e28 [0069.548] SetTimer (hWnd=0x201d2, nIDEvent=0x2070e8c, uElapse=0xbb8, lpTimerFunc=0x406ef4) returned 0x2070e8c [0069.548] SetTimer (hWnd=0x201d2, nIDEvent=0x2070fb8, uElapse=0xfa0, lpTimerFunc=0x406ef4) returned 0x2070fb8 [0069.549] SetTimer (hWnd=0x201d2, nIDEvent=0x207108c, uElapse=0x1388, lpTimerFunc=0x406ef4) returned 0x207108c [0069.549] SetTimer (hWnd=0x201d2, nIDEvent=0x2071148, uElapse=0x1770, lpTimerFunc=0x406ef4) returned 0x2071148 [0069.549] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fddc | out: phkResult=0x19fddc*=0x1d8) returned 0x0 [0069.549] RegQueryValueExA (in: hKey=0x1d8, lpValueName="Locale", lpReserved=0x0, lpType=0x19fda0, lpData=0x0, lpcbData=0x19fdbc*=0x0 | out: lpType=0x19fda0*=0x1, lpData=0x0, lpcbData=0x19fdbc*=0x9) returned 0x0 [0069.549] RegQueryValueExA (in: hKey=0x1d8, lpValueName="Locale", lpReserved=0x0, lpType=0x19fdb8, lpData=0x2071da8, lpcbData=0x19fdc8*=0x9 | out: lpType=0x19fdb8*=0x1, lpData="00000409", lpcbData=0x19fdc8*=0x9) returned 0x0 [0069.549] RegCloseKey (hKey=0x1d8) returned 0x0 [0069.549] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0069.549] TranslateMessage (lpMsg=0x413ee4) returned 0 [0069.549] DispatchMessageA (lpMsg=0x413ee4) returned 0x0 [0069.549] GetPropA (hWnd=0x201d2, lpString="SELF_") returned 0x207177c [0069.549] NtdllDefWindowProc_A (hWnd=0x201d2, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0069.549] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0070.546] TranslateMessage (lpMsg=0x413ee4) returned 0 [0070.546] DispatchMessageA (lpMsg=0x413ee4) returned 0x0 [0070.546] GetSystemTime (in: lpSystemTime=0x19fd50 | out: lpSystemTime=0x19fd50*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x6, wDay=0xf, wHour=0x0, wMinute=0x28, wSecond=0x3b, wMilliseconds=0x243)) [0070.546] KillTimer (hWnd=0x201d2, uIDEvent=0x2070dc4) returned 1 [0070.546] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0071.551] TranslateMessage (lpMsg=0x413ee4) returned 0 [0071.551] DispatchMessageA (lpMsg=0x413ee4) returned 0x0 [0071.551] GetSystemTime (in: lpSystemTime=0x19fd50 | out: lpSystemTime=0x19fd50*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x6, wDay=0xf, wHour=0x0, wMinute=0x29, wSecond=0x0, wMilliseconds=0x248)) [0071.551] KillTimer (hWnd=0x201d2, uIDEvent=0x2070e28) returned 1 [0071.551] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0072.550] TranslateMessage (lpMsg=0x413ee4) returned 0 [0072.550] DispatchMessageA (lpMsg=0x413ee4) returned 0x0 [0072.550] GetSystemTime (in: lpSystemTime=0x19fd50 | out: lpSystemTime=0x19fd50*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x6, wDay=0xf, wHour=0x0, wMinute=0x29, wSecond=0x1, wMilliseconds=0x248)) [0072.550] KillTimer (hWnd=0x201d2, uIDEvent=0x2070e8c) returned 1 [0072.551] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0073.551] TranslateMessage (lpMsg=0x413ee4) returned 0 [0073.551] DispatchMessageA (lpMsg=0x413ee4) returned 0x0 [0073.551] GetSystemTime (in: lpSystemTime=0x19fd50 | out: lpSystemTime=0x19fd50*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x6, wDay=0xf, wHour=0x0, wMinute=0x29, wSecond=0x2, wMilliseconds=0x248)) [0073.551] KillTimer (hWnd=0x201d2, uIDEvent=0x2070fb8) returned 1 [0073.551] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0074.550] TranslateMessage (lpMsg=0x413ee4) returned 0 [0074.550] DispatchMessageA (lpMsg=0x413ee4) returned 0x0 [0074.551] KillTimer (hWnd=0x201d2, uIDEvent=0x207108c) returned 1 [0074.551] GetMessageA (in: lpMsg=0x413ee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x413ee4) returned 1 [0075.552] TranslateMessage (lpMsg=0x413ee4) returned 0 [0075.552] DispatchMessageA (lpMsg=0x413ee4) [0075.552] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8411609d, dwReserved1=0xfffffffe, cFileName=".", cAlternateFileName="")) returned 0x7e2748 [0075.553] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8411609d, dwReserved1=0xfffffffe, cFileName="..", cAlternateFileName="")) returned 1 [0075.553] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xfffffffe, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0075.553] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77002d, dwReserved1=0x6e0069, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0075.554] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77002d, dwReserved1=0x6e0069, cFileName="..", cAlternateFileName="")) returned 1 [0075.554] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77002d, dwReserved1=0x6e0069, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.554] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0075.554] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.555] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0075.555] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0075.557] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.557] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0075.557] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0075.558] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0075.558] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0075.558] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0075.558] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0075.558] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0075.559] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0075.559] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0075.559] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0075.559] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0075.559] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0075.559] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0075.559] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0075.559] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0075.559] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0075.559] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0075.559] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0075.559] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0075.559] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e0069, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0075.559] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="È%~")) returned 0xffffffff [0075.560] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e0069, cFileName="Comms", cAlternateFileName="")) returned 1 [0075.560] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Comms\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0075.560] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName="..", cAlternateFileName="")) returned 1 [0075.560] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName="..", cAlternateFileName="")) returned 0 [0075.560] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0075.561] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e0069, cFileName="Desktop", cAlternateFileName="")) returned 1 [0075.561] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName="..", cAlternateFileName="È%~")) returned 0xffffffff [0075.561] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e0069, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0075.561] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName="..", cAlternateFileName="È%~")) returned 0xffffffff [0075.561] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e0069, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0075.561] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0075.561] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName="..", cAlternateFileName="")) returned 1 [0075.561] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f726564, dwReserved1=0x302e3531, cFileName="AppV", cAlternateFileName="")) returned 1 [0075.561] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0075.561] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.561] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0075.561] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0075.562] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="..", cAlternateFileName="")) returned 1 [0075.562] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0075.562] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0 [0075.562] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0075.562] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0075.562] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0075.562] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f727075, dwReserved1=0x302e3531, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0075.562] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x49656369, dwReserved1=0x6765746e, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0075.563] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x49656369, dwReserved1=0x6765746e, cFileName="..", cAlternateFileName="")) returned 1 [0075.563] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x49656369, dwReserved1=0x6765746e, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1 [0075.563] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x402ce6, dwReserved1=0x4021c3, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0075.563] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x402ce6, dwReserved1=0x4021c3, cFileName="..", cAlternateFileName="")) returned 1 [0075.564] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x402ce6, dwReserved1=0x4021c3, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0075.564] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0075.565] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0075.566] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0075.566] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.567] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0075.571] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x564f [0075.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0075.572] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0075.633] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x564f, lpOverlapped=0x0) returned 1 [0075.641] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x564f, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x564f, lpOverlapped=0x0) returned 1 [0075.643] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0075.669] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.711] CloseHandle (hObject=0x1f0) returned 1 [0075.711] CloseHandle (hObject=0x1f4) returned 1 [0075.713] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0 [0075.714] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0x20 [0075.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2688 [0075.714] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0075.714] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0075.714] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0075.715] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 0xffffffff [0075.715] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x12c, dwReserved1=0x40221d, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0075.716] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x132c, dwReserved1=0x40221d, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0075.716] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0075.716] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0075.716] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd77c4 [0075.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0075.716] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0075.852] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xd77c4, lpOverlapped=0x0) returned 1 [0076.202] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd77c4, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xd77c4, lpOverlapped=0x0) returned 1 [0076.222] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.248] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.260] CloseHandle (hObject=0x1f4) returned 1 [0076.260] CloseHandle (hObject=0x1f0) returned 1 [0076.283] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb")) returned 0 [0076.283] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb")) returned 0x20 [0076.283] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2c48 [0076.283] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0076.284] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0076.284] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0076.293] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat")) returned 0xffffffff [0076.293] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x132c, dwReserved1=0x40221d, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0076.293] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0076.293] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0076.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12b4, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0076.295] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12b4, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0076.295] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x12b4, dwReserved1=0x40221d, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0076.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0076.295] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5211 [0076.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0076.296] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0076.420] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x5211, lpOverlapped=0x0) returned 1 [0076.528] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5211, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x5211, lpOverlapped=0x0) returned 1 [0076.530] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0076.555] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.603] CloseHandle (hObject=0x1f0) returned 1 [0076.604] CloseHandle (hObject=0x1f4) returned 1 [0076.605] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0 [0076.605] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0x20 [0076.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2b48 [0076.606] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0076.606] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0076.606] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0076.607] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 0xffffffff [0076.607] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x12c, dwReserved1=0x40221d, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0076.607] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0076.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0076.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0076.608] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38480a [0076.609] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0076.609] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0076.792] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x38480a, lpOverlapped=0x0) returned 1 [0076.913] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x38480a, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x38480a, lpOverlapped=0x0) returned 1 [0077.012] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.039] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.051] CloseHandle (hObject=0x1f4) returned 1 [0077.051] CloseHandle (hObject=0x1f0) returned 1 [0077.203] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb")) returned 0 [0077.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb")) returned 0x20 [0077.204] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x7d0000, dwReserved1=0x7d0260, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2b88 [0077.204] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x7d0000, dwReserved1=0x7d0260, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.205] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0077.205] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0077.212] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat")) returned 0xffffffff [0077.212] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.212] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0077.212] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0077.212] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0077.212] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x67653631, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0077.212] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0077.213] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="..", cAlternateFileName="")) returned 1 [0077.213] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0077.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0077.217] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0077.217] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0077.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0077.221] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0077.221] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x564f [0077.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0077.222] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0077.387] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x564f, lpOverlapped=0x0) returned 1 [0077.406] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x564f, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x564f, lpOverlapped=0x0) returned 1 [0077.414] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.438] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.559] CloseHandle (hObject=0x1f0) returned 1 [0077.559] CloseHandle (hObject=0x1f4) returned 1 [0077.560] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0 [0077.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0x20 [0077.560] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2848 [0077.561] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0077.561] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0077.561] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0077.562] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 0xffffffff [0077.562] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0xc8, dwReserved1=0x40221d, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0077.562] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.563] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0077.563] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0077.564] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd77c4 [0077.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0077.564] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0077.671] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xd77c4, lpOverlapped=0x0) returned 1 [0077.718] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd77c4, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xd77c4, lpOverlapped=0x0) returned 1 [0077.775] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0077.806] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.824] CloseHandle (hObject=0x1f4) returned 1 [0077.824] CloseHandle (hObject=0x1f0) returned 1 [0077.848] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb")) returned 0 [0077.849] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb")) returned 0x20 [0077.849] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2848 [0077.849] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.849] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0077.849] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0077.860] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat")) returned 0xffffffff [0077.860] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.860] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0077.860] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0077.860] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0077.871] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0077.871] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0077.871] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0077.871] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0077.872] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5211 [0077.872] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0077.872] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0078.114] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x5211, lpOverlapped=0x0) returned 1 [0078.133] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5211, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x5211, lpOverlapped=0x0) returned 1 [0078.135] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.159] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.191] CloseHandle (hObject=0x1f0) returned 1 [0078.191] CloseHandle (hObject=0x1f4) returned 1 [0078.192] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0 [0078.193] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0x20 [0078.193] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x7d0000, dwReserved1=0x7d0260, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2608 [0078.193] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x7d0000, dwReserved1=0x7d0260, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0078.193] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0078.193] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0078.194] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 0xffffffff [0078.194] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0078.194] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0078.194] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0078.195] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.195] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38480a [0078.195] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0078.195] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0078.278] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x38480a, lpOverlapped=0x0) returned 1 [0078.379] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x38480a, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x38480a, lpOverlapped=0x0) returned 1 [0078.610] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0078.635] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.649] CloseHandle (hObject=0x1f4) returned 1 [0078.649] CloseHandle (hObject=0x1f0) returned 1 [0078.776] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb")) returned 0 [0078.776] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb")) returned 0x20 [0078.777] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x88, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2888 [0078.777] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x88, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0078.777] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0078.777] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0078.784] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat")) returned 0xffffffff [0078.785] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0078.785] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0078.785] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0078.785] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0078.785] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x67653631, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0078.785] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0078.789] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="..", cAlternateFileName="")) returned 1 [0078.789] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0078.790] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0078.793] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0078.793] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0078.793] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0078.794] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0078.794] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x564f [0078.794] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0078.795] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0078.899] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x564f, lpOverlapped=0x0) returned 1 [0078.919] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x564f, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x564f, lpOverlapped=0x0) returned 1 [0078.921] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.000] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.015] CloseHandle (hObject=0x1f0) returned 1 [0079.016] CloseHandle (hObject=0x1f4) returned 1 [0079.017] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0 [0079.017] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0x20 [0079.017] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x88, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2c88 [0079.018] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x88, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0079.018] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0079.018] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0079.019] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 0xffffffff [0079.019] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0079.020] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0079.020] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0079.020] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.021] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd77c4 [0079.021] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0079.022] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0079.189] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xd77c4, lpOverlapped=0x0) returned 1 [0079.214] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd77c4, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xd77c4, lpOverlapped=0x0) returned 1 [0079.246] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.274] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.287] CloseHandle (hObject=0x1f4) returned 1 [0079.287] CloseHandle (hObject=0x1f0) returned 1 [0079.305] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb")) returned 0 [0079.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.z49-css-qhb")) returned 0x20 [0079.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2bc8 [0079.306] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0079.306] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0079.306] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0079.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat")) returned 0xffffffff [0079.314] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0079.315] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0079.315] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0079.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0079.319] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0079.319] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0079.319] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.319] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0079.320] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5211 [0079.320] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0079.320] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0079.409] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x5211, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5211, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x5211, lpOverlapped=0x0) returned 1 [0079.434] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.513] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.537] CloseHandle (hObject=0x1f0) returned 1 [0079.537] CloseHandle (hObject=0x1f4) returned 1 [0079.538] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0 [0079.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0x20 [0079.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x88, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2848 [0079.539] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x88, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0079.539] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0079.539] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0079.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 0xffffffff [0079.540] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0079.540] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0079.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0079.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0079.540] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38480a [0079.541] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0079.541] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0079.623] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x38480a, lpOverlapped=0x0) returned 1 [0079.811] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x38480a, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x38480a, lpOverlapped=0x0) returned 1 [0079.920] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0079.946] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.959] CloseHandle (hObject=0x1f4) returned 1 [0079.959] CloseHandle (hObject=0x1f0) returned 1 [0080.272] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb")) returned 0 [0080.272] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.z49-css-qhb")) returned 0x20 [0080.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x88, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2688 [0080.273] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x88, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0080.273] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0080.273] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0080.274] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat")) returned 0xffffffff [0080.274] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0080.274] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0080.274] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e343678, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0080.274] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0080.274] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x2e656e6f, dwReserved1=0x67653631, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0080.274] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0080.274] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0080.275] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b6 [0080.275] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0080.275] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0080.527] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7b6, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x7b6, lpOverlapped=0x0) returned 1 [0080.532] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7b6, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x7b6, lpOverlapped=0x0) returned 1 [0080.533] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.571] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.589] CloseHandle (hObject=0x1e8) returned 1 [0080.590] CloseHandle (hObject=0x1ec) returned 1 [0080.591] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.z49-css-qhb")) returned 0 [0080.591] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.z49-css-qhb")) returned 0x20 [0080.591] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x54, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0x7e2508 [0080.592] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x54, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0 [0080.592] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0080.592] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 1 [0080.593] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 0xffffffff [0080.593] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1 [0080.593] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0080.594] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0080.594] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b4 [0080.594] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0080.594] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0080.678] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x7b4, lpOverlapped=0x0) returned 1 [0080.680] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x7b4, lpOverlapped=0x0) returned 1 [0080.684] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.710] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.727] CloseHandle (hObject=0x1ec) returned 1 [0080.727] CloseHandle (hObject=0x1e8) returned 1 [0080.728] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.z49-css-qhb")) returned 0 [0080.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.z49-css-qhb")) returned 0x20 [0080.728] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 0x7e2a88 [0080.729] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 0 [0080.729] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0080.729] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 1 [0080.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 0xffffffff [0080.730] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0080.730] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0080.730] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0080.731] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x566 [0080.731] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0080.731] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0080.823] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x566, lpOverlapped=0x0) returned 1 [0080.825] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x566, lpOverlapped=0x0) returned 1 [0080.827] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.852] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.873] CloseHandle (hObject=0x1e8) returned 1 [0080.873] CloseHandle (hObject=0x1ec) returned 1 [0080.874] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.z49-css-qhb")) returned 0 [0080.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.z49-css-qhb")) returned 0x20 [0080.875] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 0x7e2688 [0080.875] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 0 [0080.875] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0080.875] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 1 [0080.876] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 0xffffffff [0080.876] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0080.876] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0080.877] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.877] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0080.877] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0080.877] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="..", cAlternateFileName="")) returned 1 [0080.877] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="Packages", cAlternateFileName="")) returned 1 [0080.877] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0080.877] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0080.877] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0080.878] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0080.878] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.878] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0080.878] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0080.879] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.879] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0080.880] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0080.880] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0080.880] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0080.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0080.881] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0080.967] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x266, lpOverlapped=0x0) returned 1 [0080.969] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x266, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x266, lpOverlapped=0x0) returned 1 [0080.971] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0080.996] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.020] CloseHandle (hObject=0x1fc) returned 1 [0081.020] CloseHandle (hObject=0x200) returned 1 [0081.021] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.z49-css-qhb")) returned 0 [0081.022] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.z49-css-qhb")) returned 0x20 [0081.022] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0x7e2c08 [0081.022] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0 [0081.023] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0081.023] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 1 [0081.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 0xffffffff [0081.024] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Manifest.xml", cAlternateFileName="")) returned 1 [0081.024] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0081.024] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0081.024] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ab2f7 [0081.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0081.025] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0081.261] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x500000, lpOverlapped=0x0) returned 1 [0081.713] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x500000, lpOverlapped=0x0) returned 1 [0082.081] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0xab2f7, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0xab2f7, lpOverlapped=0x0) returned 1 [0082.100] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xab2f7, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0xab2f7, lpOverlapped=0x0) returned 1 [0082.131] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.182] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.197] CloseHandle (hObject=0x200) returned 1 [0082.198] CloseHandle (hObject=0x1fc) returned 1 [0082.556] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.z49-css-qhb")) returned 0 [0082.557] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.z49-css-qhb")) returned 0x20 [0082.557] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Manifest.xml", cAlternateFileName="")) returned 0x7e2a88 [0082.557] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Manifest.xml", cAlternateFileName="")) returned 0 [0082.557] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0082.557] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 1 [0082.557] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 0xffffffff [0082.557] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1 [0082.558] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0082.558] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0082.558] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0082.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0082.559] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0082.669] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x266, lpOverlapped=0x0) returned 1 [0082.671] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x266, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x266, lpOverlapped=0x0) returned 1 [0082.672] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0082.707] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.719] CloseHandle (hObject=0x1fc) returned 1 [0082.719] CloseHandle (hObject=0x200) returned 1 [0082.719] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.z49-css-qhb")) returned 0 [0082.720] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.z49-css-qhb")) returned 0x20 [0082.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 0x7e2688 [0082.720] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 0 [0082.720] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0082.720] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 1 [0082.721] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 0xffffffff [0082.721] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1 [0082.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0082.722] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0082.722] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38e9a8 [0082.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0082.723] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0082.801] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x38e9a8, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x38e9a8, lpOverlapped=0x0) returned 1 [0082.987] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x38e9a8, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x38e9a8, lpOverlapped=0x0) returned 1 [0083.401] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.478] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.491] CloseHandle (hObject=0x200) returned 1 [0083.491] CloseHandle (hObject=0x1fc) returned 1 [0083.913] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.z49-css-qhb")) returned 0 [0083.913] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.z49-css-qhb")) returned 0x20 [0083.913] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0x7e2688 [0083.914] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0083.914] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0083.914] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 1 [0083.920] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 0xffffffff [0083.920] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0083.920] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0083.920] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0083.920] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0083.920] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0083.920] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0083.920] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="Packages", cAlternateFileName="")) returned 0 [0083.920] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0083.920] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x73, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0083.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0083.921] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName="..", cAlternateFileName="")) returned 1 [0083.921] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0083.921] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38303338, dwReserved1=0x392d3743, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0083.921] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38303338, dwReserved1=0x392d3743, cFileName="..", cAlternateFileName="")) returned 1 [0083.921] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38303338, dwReserved1=0x392d3743, cFileName="..", cAlternateFileName="")) returned 0 [0083.921] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0083.921] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0083.921] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0083.921] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x73, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0083.921] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0083.921] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61726765, dwReserved1=0x6e6f6974, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0083.921] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x63614274, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0083.928] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x63614274, cFileName="..", cAlternateFileName="")) returned 1 [0083.928] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x63614274, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1 [0083.928] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0083.929] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName="..", cAlternateFileName="")) returned 1 [0083.929] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0083.929] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0083.984] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0083.984] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0083.984] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0083.985] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0083.985] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bec [0083.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0083.985] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0084.116] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5bec, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x5bec, lpOverlapped=0x0) returned 1 [0084.118] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5bec, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x5bec, lpOverlapped=0x0) returned 1 [0084.119] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.161] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.173] CloseHandle (hObject=0x1f4) returned 1 [0084.173] CloseHandle (hObject=0x1f8) returned 1 [0084.175] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0 [0084.176] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.z49-css-qhb")) returned 0x20 [0084.176] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2c48 [0084.176] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0084.176] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0084.176] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0084.177] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 0xffffffff [0084.177] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0084.178] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x174, dwReserved1=0x40221d, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0084.178] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0084.178] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0084.179] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dff67 [0084.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0084.179] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0084.500] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1dff67, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x1dff67, lpOverlapped=0x0) returned 1 [0084.610] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1dff67, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x1dff67, lpOverlapped=0x0) returned 1 [0084.685] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.714] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.729] CloseHandle (hObject=0x1f8) returned 1 [0084.729] CloseHandle (hObject=0x1f4) returned 1 [0084.784] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.z49-css-qhb")) returned 0 [0084.785] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.z49-css-qhb")) returned 0x20 [0084.785] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 0x7e2bc8 [0084.785] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 0 [0084.785] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0084.785] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) returned 1 [0084.793] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) returned 0xffffffff [0084.794] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0084.794] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x58, dwReserved1=0x40221d, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0084.794] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0084.795] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0084.795] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108693 [0084.795] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0084.796] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0084.887] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x108693, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x108693, lpOverlapped=0x0) returned 1 [0084.933] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x108693, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x108693, lpOverlapped=0x0) returned 1 [0084.961] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.042] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.059] CloseHandle (hObject=0x1f4) returned 1 [0085.059] CloseHandle (hObject=0x1f8) returned 1 [0085.090] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb")) returned 0 [0085.091] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb")) returned 0x20 [0085.091] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2a88 [0085.091] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0085.091] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0085.091] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) returned 1 [0085.093] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0xffffffff [0085.093] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x58, dwReserved1=0x40221d, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0085.093] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0085.093] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0085.093] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0085.106] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0085.106] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0085.107] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0085.107] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0085.108] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b31 [0085.108] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0085.108] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0085.235] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5b31, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x5b31, lpOverlapped=0x0) returned 1 [0085.241] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5b31, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x5b31, lpOverlapped=0x0) returned 1 [0085.242] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.274] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.291] CloseHandle (hObject=0x1f8) returned 1 [0085.291] CloseHandle (hObject=0x1f4) returned 1 [0085.307] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0 [0085.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.z49-css-qhb")) returned 0x20 [0085.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2608 [0085.308] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0085.308] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0085.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0085.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 0xffffffff [0085.310] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0085.310] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0085.318] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0085.324] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0085.324] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e0a5c [0085.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0085.325] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0085.476] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x500000, lpOverlapped=0x0) returned 1 [0085.831] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x500000, lpOverlapped=0x0) returned 1 [0085.997] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2e0a5c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x2e0a5c, lpOverlapped=0x0) returned 1 [0086.059] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2e0a5c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x2e0a5c, lpOverlapped=0x0) returned 1 [0086.122] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.164] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.176] CloseHandle (hObject=0x1f4) returned 1 [0086.177] CloseHandle (hObject=0x1f8) returned 1 [0086.493] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.z49-css-qhb")) returned 0 [0086.493] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.z49-css-qhb")) returned 0x20 [0086.493] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 0x7e2c08 [0086.493] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 0 [0086.493] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0086.493] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) returned 1 [0086.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) returned 0xffffffff [0086.502] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x4c, dwReserved1=0x40221d, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0086.502] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0086.502] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0086.503] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0086.503] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x460b47 [0086.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0086.504] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0086.636] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x460b47, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x460b47, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x460b47, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x460b47, lpOverlapped=0x0) returned 1 [0086.903] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.937] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.948] CloseHandle (hObject=0x1f8) returned 1 [0086.948] CloseHandle (hObject=0x1f4) returned 1 [0087.208] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb")) returned 0 [0087.211] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb")) returned 0x20 [0087.211] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2608 [0087.211] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0087.211] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0087.211] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat")) returned 1 [0087.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0xffffffff [0087.214] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0087.214] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0087.214] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0087.214] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0087.214] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0087.214] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0087.217] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName="..", cAlternateFileName="")) returned 1 [0087.217] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0087.217] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0087.268] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0087.268] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x20, dwReserved1=0x3000003, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0087.268] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0087.270] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0087.271] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108693 [0087.271] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0087.272] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0087.395] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x108693, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x108693, lpOverlapped=0x0) returned 1 [0087.444] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x108693, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x108693, lpOverlapped=0x0) returned 1 [0087.466] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.509] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.521] CloseHandle (hObject=0x1f4) returned 1 [0087.521] CloseHandle (hObject=0x1f8) returned 1 [0087.659] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb")) returned 0 [0087.659] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat.z49-css-qhb")) returned 0x20 [0087.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2a88 [0087.660] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0087.660] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0087.660] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 1 [0087.662] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0xffffffff [0087.662] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x20, dwReserved1=0x3000003, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0087.662] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0087.662] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0087.662] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0087.664] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0087.665] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0087.665] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0087.666] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0087.666] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x460b47 [0087.666] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0087.667] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0087.759] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x460b47, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x460b47, lpOverlapped=0x0) returned 1 [0087.949] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x460b47, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x460b47, lpOverlapped=0x0) returned 1 [0088.057] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.082] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.094] CloseHandle (hObject=0x1f8) returned 1 [0088.094] CloseHandle (hObject=0x1f4) returned 1 [0088.243] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb")) returned 0 [0088.244] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat.z49-css-qhb")) returned 0x20 [0088.244] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x7e2b48 [0088.244] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0088.244] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0088.244] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 1 [0088.257] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0xffffffff [0088.257] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0088.257] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0088.257] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6165, dwReserved1=0x2e363878, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0088.257] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0088.257] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0088.257] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0088.257] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30333738, dwReserved1=0x32392d32, cFileName="UserData", cAlternateFileName="")) returned 1 [0088.257] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0088.258] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName="..", cAlternateFileName="")) returned 1 [0088.258] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName="..", cAlternateFileName="")) returned 0 [0088.258] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0088.258] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30333738, dwReserved1=0x32392d32, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0088.258] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0088.260] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName="..", cAlternateFileName="")) returned 1 [0088.262] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x2e656e6f, dwReserved1=0x63613631, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1 [0088.262] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x60, dwReserved1=0x40221d, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1 [0088.262] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0088.263] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.264] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91f0 [0088.264] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0088.265] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0088.369] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x91f0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x91f0, lpOverlapped=0x0) returned 1 [0088.415] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x91f0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x91f0, lpOverlapped=0x0) returned 1 [0088.417] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.443] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.461] CloseHandle (hObject=0x1e8) returned 1 [0088.461] CloseHandle (hObject=0x1f0) returned 1 [0088.463] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0088.463] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0088.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 0x7e2a48 [0088.464] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 0 [0088.464] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0088.464] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 1 [0088.465] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0xffffffff [0088.465] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1 [0088.465] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.466] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0088.466] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe71c [0088.466] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0088.466] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0088.605] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe71c, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xe71c, lpOverlapped=0x0) returned 1 [0088.674] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe71c, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xe71c, lpOverlapped=0x0) returned 1 [0088.676] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.699] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.712] CloseHandle (hObject=0x1f0) returned 1 [0088.712] CloseHandle (hObject=0x1e8) returned 1 [0088.714] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0088.715] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0088.715] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 0x7e2508 [0088.715] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 0 [0088.715] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0088.715] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 1 [0088.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0xffffffff [0088.717] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1 [0088.717] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0088.727] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0088.728] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0088.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0088.728] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0088.885] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x7fa, lpOverlapped=0x0) returned 1 [0088.913] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x7fa, lpOverlapped=0x0) returned 1 [0088.915] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.946] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.076] CloseHandle (hObject=0x1e8) returned 1 [0089.076] CloseHandle (hObject=0x1f0) returned 1 [0089.077] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0089.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0089.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 0x7e2608 [0089.078] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 0 [0089.078] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0089.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 1 [0089.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0xffffffff [0089.080] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1 [0089.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0089.081] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f14 [0089.081] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0089.081] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0089.168] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f14, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3f14, lpOverlapped=0x0) returned 1 [0089.210] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f14, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3f14, lpOverlapped=0x0) returned 1 [0089.211] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.252] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.263] CloseHandle (hObject=0x1f0) returned 1 [0089.264] CloseHandle (hObject=0x1e8) returned 1 [0089.303] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0089.303] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0089.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 0x7e2888 [0089.303] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 0 [0089.304] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0089.304] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 1 [0089.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0xffffffff [0089.305] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1 [0089.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0089.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.305] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x265a [0089.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0089.306] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0089.385] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x265a, lpOverlapped=0x0) returned 1 [0089.389] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x265a, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x265a, lpOverlapped=0x0) returned 1 [0089.403] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.428] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.443] CloseHandle (hObject=0x1e8) returned 1 [0089.444] CloseHandle (hObject=0x1f0) returned 1 [0089.445] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0089.445] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0089.445] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 0x7e2a48 [0089.446] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 0 [0089.446] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0089.446] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 1 [0089.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0xffffffff [0089.447] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1 [0089.447] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0089.448] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39d9c [0089.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0089.449] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0089.640] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x39d9c, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x39d9c, lpOverlapped=0x0) returned 1 [0089.652] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x39d9c, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x39d9c, lpOverlapped=0x0) returned 1 [0089.663] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.733] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.752] CloseHandle (hObject=0x1f0) returned 1 [0089.752] CloseHandle (hObject=0x1e8) returned 1 [0089.757] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0089.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0089.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 0x7e2ac8 [0089.758] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 0 [0089.758] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0089.758] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 1 [0089.760] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0xffffffff [0089.760] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1 [0089.761] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0089.761] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.761] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f70 [0089.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0089.762] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0089.852] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8f70, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x8f70, lpOverlapped=0x0) returned 1 [0089.876] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x8f70, lpOverlapped=0x0) returned 1 [0089.877] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.903] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.919] CloseHandle (hObject=0x1e8) returned 1 [0089.919] CloseHandle (hObject=0x1f0) returned 1 [0089.921] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0089.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0089.922] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 0x7e2c88 [0089.922] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 0 [0089.922] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0089.922] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 1 [0089.924] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0xffffffff [0089.924] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1 [0089.924] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0089.924] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0089.924] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8e [0089.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0089.925] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0089.994] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8f8e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x8f8e, lpOverlapped=0x0) returned 1 [0090.032] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8f8e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x8f8e, lpOverlapped=0x0) returned 1 [0090.033] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.061] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.074] CloseHandle (hObject=0x1f0) returned 1 [0090.074] CloseHandle (hObject=0x1e8) returned 1 [0090.076] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0090.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0090.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 0x7e2c08 [0090.077] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 0 [0090.078] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0090.078] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 1 [0090.121] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0xffffffff [0090.122] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1 [0090.122] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0090.123] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0090.123] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180e [0090.123] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0090.124] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0090.271] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x180e, lpOverlapped=0x0) returned 1 [0090.445] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x180e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x180e, lpOverlapped=0x0) returned 1 [0090.446] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.470] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.482] CloseHandle (hObject=0x1e8) returned 1 [0090.482] CloseHandle (hObject=0x1f0) returned 1 [0090.483] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0090.483] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0090.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 0x7e26c8 [0090.484] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 0 [0090.484] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0090.484] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 1 [0090.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0xffffffff [0090.528] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1 [0090.528] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0090.529] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0090.529] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1979c [0090.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0090.530] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0090.643] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1979c, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1979c, lpOverlapped=0x0) returned 1 [0090.725] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1979c, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1979c, lpOverlapped=0x0) returned 1 [0090.728] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.752] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.763] CloseHandle (hObject=0x1f0) returned 1 [0090.764] CloseHandle (hObject=0x1e8) returned 1 [0090.766] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0090.767] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0090.767] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 0x7e2a48 [0090.767] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 0 [0090.767] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0090.767] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 1 [0090.778] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0xffffffff [0090.778] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1 [0090.778] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0090.778] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0090.778] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b94 [0090.778] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0090.779] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0090.852] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5b94, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x5b94, lpOverlapped=0x0) returned 1 [0090.855] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5b94, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x5b94, lpOverlapped=0x0) returned 1 [0090.856] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.880] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.892] CloseHandle (hObject=0x1e8) returned 1 [0090.892] CloseHandle (hObject=0x1f0) returned 1 [0090.893] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0090.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0090.899] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 0x7e2a48 [0090.902] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 0 [0090.902] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0090.902] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 1 [0090.903] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0xffffffff [0090.903] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1 [0090.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0090.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0090.904] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b4a [0090.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0090.905] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0090.977] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6b4a, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x6b4a, lpOverlapped=0x0) returned 1 [0091.004] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6b4a, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x6b4a, lpOverlapped=0x0) returned 1 [0091.006] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.037] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.060] CloseHandle (hObject=0x1f0) returned 1 [0091.060] CloseHandle (hObject=0x1e8) returned 1 [0091.061] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0091.062] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0091.062] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 0x7e2ac8 [0091.062] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 0 [0091.062] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0091.063] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 1 [0091.064] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 0xffffffff [0091.064] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1 [0091.064] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0091.066] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0091.066] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3f4 [0091.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0091.066] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0091.242] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4f3f4, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4f3f4, lpOverlapped=0x0) returned 1 [0091.276] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4f3f4, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4f3f4, lpOverlapped=0x0) returned 1 [0091.282] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.306] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.340] CloseHandle (hObject=0x1e8) returned 1 [0091.340] CloseHandle (hObject=0x1f0) returned 1 [0091.347] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0091.348] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0091.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 0x7e26c8 [0091.348] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 0 [0091.348] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0091.348] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 1 [0091.352] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 0xffffffff [0091.352] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1 [0091.352] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0091.352] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0091.353] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19870 [0091.353] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0091.353] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0091.429] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x19870, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x19870, lpOverlapped=0x0) returned 1 [0091.433] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x19870, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x19870, lpOverlapped=0x0) returned 1 [0091.435] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.461] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.482] CloseHandle (hObject=0x1f0) returned 1 [0091.483] CloseHandle (hObject=0x1e8) returned 1 [0091.486] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0091.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0091.488] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 0x7e2b08 [0091.488] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 0 [0091.488] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0091.488] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 1 [0091.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0xffffffff [0091.491] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1 [0091.491] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0091.492] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0091.492] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0091.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0091.493] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0091.670] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x7fa, lpOverlapped=0x0) returned 1 [0091.677] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x7fa, lpOverlapped=0x0) returned 1 [0091.678] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.702] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.715] CloseHandle (hObject=0x1e8) returned 1 [0091.715] CloseHandle (hObject=0x1f0) returned 1 [0091.716] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0091.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0091.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 0x7e2648 [0091.717] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 0 [0091.717] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0091.717] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 1 [0091.718] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0xffffffff [0091.718] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1 [0091.718] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0091.718] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0091.718] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b3c [0091.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0091.719] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0091.792] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x17b3c, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x17b3c, lpOverlapped=0x0) returned 1 [0091.966] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x17b3c, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x17b3c, lpOverlapped=0x0) returned 1 [0091.968] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.004] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.016] CloseHandle (hObject=0x1f0) returned 1 [0092.016] CloseHandle (hObject=0x1e8) returned 1 [0092.023] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0092.023] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0092.023] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 0x7e2888 [0092.023] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 0 [0092.023] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0092.024] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 1 [0092.025] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0xffffffff [0092.025] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1 [0092.025] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0092.025] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0092.026] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a4a [0092.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0092.026] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0092.107] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4a4a, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4a4a, lpOverlapped=0x0) returned 1 [0092.113] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4a4a, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4a4a, lpOverlapped=0x0) returned 1 [0092.114] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.154] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.167] CloseHandle (hObject=0x1e8) returned 1 [0092.168] CloseHandle (hObject=0x1f0) returned 1 [0092.169] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0092.169] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0092.169] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 0x7e2908 [0092.170] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 0 [0092.170] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0092.170] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 1 [0092.171] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0xffffffff [0092.171] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x344, dwReserved1=0x40221d, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1 [0092.171] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0092.172] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0092.176] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f6 [0092.176] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0092.176] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0092.297] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5f6, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x5f6, lpOverlapped=0x0) returned 1 [0092.299] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5f6, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x5f6, lpOverlapped=0x0) returned 1 [0092.300] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.326] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.337] CloseHandle (hObject=0x1f0) returned 1 [0092.337] CloseHandle (hObject=0x1e8) returned 1 [0092.338] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0092.339] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0092.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 0x7e2888 [0092.339] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 0 [0092.339] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0092.339] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 1 [0092.340] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0xffffffff [0092.340] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1 [0092.341] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0092.341] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0092.341] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b28 [0092.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0092.341] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0092.423] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2b28, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2b28, lpOverlapped=0x0) returned 1 [0092.640] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2b28, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2b28, lpOverlapped=0x0) returned 1 [0092.641] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.665] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.690] CloseHandle (hObject=0x1e8) returned 1 [0092.690] CloseHandle (hObject=0x1f0) returned 1 [0092.694] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0092.694] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0092.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 0x7e2c48 [0092.694] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 0 [0092.694] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0092.695] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 1 [0092.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0xffffffff [0092.696] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1 [0092.696] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0092.696] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0092.697] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x906 [0092.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0092.697] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0092.789] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x906, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x906, lpOverlapped=0x0) returned 1 [0092.814] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x906, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x906, lpOverlapped=0x0) returned 1 [0092.815] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.839] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.853] CloseHandle (hObject=0x1f0) returned 1 [0092.853] CloseHandle (hObject=0x1e8) returned 1 [0092.855] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0092.855] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0092.855] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 0x7e26c8 [0092.855] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 0 [0092.855] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0092.856] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 1 [0092.857] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0xffffffff [0092.857] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1 [0092.857] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0092.858] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0092.858] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8a [0092.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0092.859] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0092.937] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2b8a, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2b8a, lpOverlapped=0x0) returned 1 [0092.945] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2b8a, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2b8a, lpOverlapped=0x0) returned 1 [0092.946] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.970] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.982] CloseHandle (hObject=0x1e8) returned 1 [0092.982] CloseHandle (hObject=0x1f0) returned 1 [0092.983] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0092.983] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0092.984] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 0x7e2c08 [0092.984] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 0 [0092.984] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0092.984] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 1 [0092.985] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0xffffffff [0092.985] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x344, dwReserved1=0x40221d, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1 [0092.985] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0092.986] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0092.986] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17194 [0092.986] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0092.986] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0093.064] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x17194, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x17194, lpOverlapped=0x0) returned 1 [0093.250] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x17194, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x17194, lpOverlapped=0x0) returned 1 [0093.257] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.294] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.307] CloseHandle (hObject=0x1f0) returned 1 [0093.307] CloseHandle (hObject=0x1e8) returned 1 [0093.310] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0093.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0093.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 0x7e2888 [0093.311] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 0 [0093.311] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0093.311] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 1 [0093.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0xffffffff [0093.312] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1 [0093.312] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0093.313] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0093.313] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17984 [0093.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0093.314] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0093.389] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x17984, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x17984, lpOverlapped=0x0) returned 1 [0093.399] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x17984, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x17984, lpOverlapped=0x0) returned 1 [0093.401] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.425] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.437] CloseHandle (hObject=0x1e8) returned 1 [0093.437] CloseHandle (hObject=0x1f0) returned 1 [0093.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0093.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0093.448] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 0x7e2ac8 [0093.448] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 0 [0093.448] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0093.448] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 1 [0093.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0xffffffff [0093.450] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1 [0093.450] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0093.451] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0093.451] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xafddc [0093.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0093.451] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0093.561] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xafddc, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xafddc, lpOverlapped=0x0) returned 1 [0093.575] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xafddc, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xafddc, lpOverlapped=0x0) returned 1 [0093.653] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.684] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.696] CloseHandle (hObject=0x1f0) returned 1 [0093.696] CloseHandle (hObject=0x1e8) returned 1 [0093.754] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0093.755] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0093.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 0x7e2608 [0093.755] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 0 [0093.755] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0093.755] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 1 [0093.762] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0xffffffff [0093.762] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1 [0093.762] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0093.762] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0093.762] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x195a4 [0093.762] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0093.763] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0093.842] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x195a4, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x195a4, lpOverlapped=0x0) returned 1 [0094.005] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x195a4, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x195a4, lpOverlapped=0x0) returned 1 [0094.008] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.031] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.043] CloseHandle (hObject=0x1e8) returned 1 [0094.044] CloseHandle (hObject=0x1f0) returned 1 [0094.091] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0094.092] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0094.092] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 0x7e2c88 [0094.092] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 0 [0094.093] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0094.093] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 1 [0094.093] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0xffffffff [0094.093] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1 [0094.093] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0094.094] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0094.094] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x689e [0094.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0094.095] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0094.173] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x689e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x689e, lpOverlapped=0x0) returned 1 [0094.228] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x689e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x689e, lpOverlapped=0x0) returned 1 [0094.229] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.253] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.264] CloseHandle (hObject=0x1f0) returned 1 [0094.265] CloseHandle (hObject=0x1e8) returned 1 [0094.266] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0094.266] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0094.267] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 0x7e26c8 [0094.267] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 0 [0094.267] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0094.267] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 1 [0094.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0xffffffff [0094.300] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1 [0094.300] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0094.301] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0094.302] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7446 [0094.302] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0094.302] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0094.426] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7446, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x7446, lpOverlapped=0x0) returned 1 [0094.472] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7446, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x7446, lpOverlapped=0x0) returned 1 [0094.473] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.497] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.555] CloseHandle (hObject=0x1e8) returned 1 [0094.556] CloseHandle (hObject=0x1f0) returned 1 [0094.557] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0094.558] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0094.558] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 0x7e2a48 [0094.558] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 0 [0094.558] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0094.558] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 1 [0094.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 0xffffffff [0094.560] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1 [0094.560] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0094.560] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0094.560] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x809e [0094.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0094.561] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0094.691] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x809e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x809e, lpOverlapped=0x0) returned 1 [0094.852] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x809e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x809e, lpOverlapped=0x0) returned 1 [0094.853] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.877] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.889] CloseHandle (hObject=0x1f0) returned 1 [0094.889] CloseHandle (hObject=0x1e8) returned 1 [0094.891] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0094.891] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0094.891] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 0x7e2ac8 [0094.891] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 0 [0094.891] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0094.892] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 1 [0094.893] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 0xffffffff [0094.893] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x344, dwReserved1=0x40221d, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1 [0094.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0094.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0094.893] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x63ae [0094.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0094.894] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0095.156] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x63ae, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x63ae, lpOverlapped=0x0) returned 1 [0095.201] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x63ae, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x63ae, lpOverlapped=0x0) returned 1 [0095.202] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.226] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.237] CloseHandle (hObject=0x1e8) returned 1 [0095.237] CloseHandle (hObject=0x1f0) returned 1 [0095.286] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0095.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0095.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 0x7e2648 [0095.287] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 0 [0095.287] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0095.287] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 1 [0095.288] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0xffffffff [0095.288] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x38, dwReserved1=0x40221d, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1 [0095.288] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0095.289] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0095.289] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fee [0095.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0095.290] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0095.397] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x5fee, lpOverlapped=0x0) returned 1 [0095.420] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5fee, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x5fee, lpOverlapped=0x0) returned 1 [0095.421] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.495] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.507] CloseHandle (hObject=0x1f0) returned 1 [0095.507] CloseHandle (hObject=0x1e8) returned 1 [0095.509] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.z49-css-qhb")) returned 0 [0095.509] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.z49-css-qhb")) returned 0x20 [0095.509] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 0x7e2c48 [0095.509] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 0 [0095.509] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0095.509] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 1 [0095.511] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0xffffffff [0095.511] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1 [0095.511] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0095.511] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0095.511] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fee [0095.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0095.512] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0095.684] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x5fee, lpOverlapped=0x0) returned 1 [0095.776] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5fee, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x5fee, lpOverlapped=0x0) returned 1 [0095.778] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.802] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.814] CloseHandle (hObject=0x1e8) returned 1 [0095.814] CloseHandle (hObject=0x1f0) returned 1 [0095.815] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.z49-css-qhb")) returned 0 [0095.834] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.z49-css-qhb")) returned 0x20 [0095.834] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 0x7e2a48 [0095.834] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 0 [0095.834] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0095.834] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 1 [0095.835] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0xffffffff [0095.835] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1 [0095.836] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0095.836] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0095.836] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0095.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0095.837] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0095.945] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x7fa, lpOverlapped=0x0) returned 1 [0096.043] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x7fa, lpOverlapped=0x0) returned 1 [0096.045] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.070] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.130] CloseHandle (hObject=0x1f0) returned 1 [0096.130] CloseHandle (hObject=0x1e8) returned 1 [0096.132] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0096.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0096.132] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 0x7e2888 [0096.132] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 0 [0096.132] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0096.132] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 1 [0096.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0xffffffff [0096.134] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1 [0096.134] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0096.134] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0096.135] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12e4a [0096.135] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0096.135] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0096.251] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x12e4a, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x12e4a, lpOverlapped=0x0) returned 1 [0096.253] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x12e4a, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x12e4a, lpOverlapped=0x0) returned 1 [0096.256] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.326] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.339] CloseHandle (hObject=0x1e8) returned 1 [0096.339] CloseHandle (hObject=0x1f0) returned 1 [0096.342] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0096.343] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0096.343] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 0x7e2b48 [0096.343] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 0 [0096.343] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0096.343] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 1 [0096.345] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0xffffffff [0096.345] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1 [0096.345] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0096.345] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0096.345] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3734 [0096.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0096.347] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0096.511] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3734, lpOverlapped=0x0) returned 1 [0096.732] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3734, lpOverlapped=0x0) returned 1 [0096.733] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.758] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.817] CloseHandle (hObject=0x1f0) returned 1 [0096.817] CloseHandle (hObject=0x1e8) returned 1 [0096.819] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0096.819] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0096.819] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 0x7e2c08 [0096.820] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 0 [0096.820] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0096.820] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 1 [0096.821] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0xffffffff [0096.821] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1 [0096.821] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0096.822] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0096.822] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb27ee [0096.822] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0096.823] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0096.949] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb27ee, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xb27ee, lpOverlapped=0x0) returned 1 [0097.121] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb27ee, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xb27ee, lpOverlapped=0x0) returned 1 [0097.139] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.220] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.232] CloseHandle (hObject=0x1e8) returned 1 [0097.232] CloseHandle (hObject=0x1f0) returned 1 [0097.373] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0097.373] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0097.374] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 0x7e2888 [0097.374] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 0 [0097.374] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0097.374] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 1 [0097.381] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0xffffffff [0097.381] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1 [0097.382] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0097.382] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0097.383] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2aafe [0097.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0097.383] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0097.491] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2aafe, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2aafe, lpOverlapped=0x0) returned 1 [0097.794] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2aafe, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2aafe, lpOverlapped=0x0) returned 1 [0097.798] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.823] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.867] CloseHandle (hObject=0x1f0) returned 1 [0097.867] CloseHandle (hObject=0x1e8) returned 1 [0097.871] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0097.872] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0097.872] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 0x7e2888 [0097.872] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 0 [0097.872] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0097.873] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 1 [0097.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 0xffffffff [0097.875] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1 [0097.875] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0097.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0097.876] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0cb4 [0097.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0097.877] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0097.988] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xf0cb4, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xf0cb4, lpOverlapped=0x0) returned 1 [0098.043] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xf0cb4, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xf0cb4, lpOverlapped=0x0) returned 1 [0098.065] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.213] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.236] CloseHandle (hObject=0x1e8) returned 1 [0098.236] CloseHandle (hObject=0x1f0) returned 1 [0098.329] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0098.330] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0098.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 0x7e2888 [0098.330] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 0 [0098.330] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0098.330] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 1 [0098.339] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 0xffffffff [0098.339] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1 [0098.339] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0098.339] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0098.340] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1536e [0098.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0098.340] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0098.488] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1536e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1536e, lpOverlapped=0x0) returned 1 [0098.777] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1536e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1536e, lpOverlapped=0x0) returned 1 [0098.780] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.804] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.873] CloseHandle (hObject=0x1f0) returned 1 [0098.873] CloseHandle (hObject=0x1e8) returned 1 [0098.923] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0 [0098.927] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.z49-css-qhb")) returned 0x20 [0098.927] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 0x7e2bc8 [0098.927] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 0 [0098.927] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0098.927] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 1 [0098.929] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0xffffffff [0098.929] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1 [0098.929] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0098.930] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0098.930] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130fe [0098.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0098.930] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0099.054] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x130fe, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x130fe, lpOverlapped=0x0) returned 1 [0099.070] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x130fe, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x130fe, lpOverlapped=0x0) returned 1 [0099.072] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.131] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.147] CloseHandle (hObject=0x1e8) returned 1 [0099.148] CloseHandle (hObject=0x1f0) returned 1 [0099.150] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.z49-css-qhb")) returned 0 [0099.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.z49-css-qhb")) returned 0x20 [0099.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 0x7e2508 [0099.151] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x88, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 0 [0099.151] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0099.151] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 1 [0099.153] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0xffffffff [0099.153] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0099.153] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0099.154] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0099.154] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c470 [0099.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0099.154] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0099.309] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x12c470, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x12c470, lpOverlapped=0x0) returned 1 [0099.399] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x12c470, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x12c470, lpOverlapped=0x0) returned 1 [0099.445] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.538] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.550] CloseHandle (hObject=0x1f0) returned 1 [0099.550] CloseHandle (hObject=0x1e8) returned 1 [0099.576] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.z49-css-qhb")) returned 0 [0099.577] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.z49-css-qhb")) returned 0x20 [0099.577] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 0x7e2b88 [0099.577] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 0 [0099.577] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0099.577] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 1 [0099.579] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 0xffffffff [0099.579] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0099.579] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0099.711] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0099.712] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce8 [0099.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0099.712] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0099.921] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xce8, lpOverlapped=0x0) returned 1 [0099.923] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xce8, lpOverlapped=0x0) returned 1 [0099.925] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.012] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.026] CloseHandle (hObject=0x1e8) returned 1 [0100.026] CloseHandle (hObject=0x1f0) returned 1 [0100.028] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.z49-css-qhb")) returned 0 [0100.029] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.z49-css-qhb")) returned 0x20 [0100.029] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 0x7e2b08 [0100.029] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 0 [0100.029] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0100.029] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 1 [0100.031] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 0xffffffff [0100.031] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0100.031] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0100.032] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0100.032] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca6 [0100.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0100.033] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0100.218] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xca6, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xca6, lpOverlapped=0x0) returned 1 [0100.219] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xca6, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xca6, lpOverlapped=0x0) returned 1 [0100.220] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.320] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.335] CloseHandle (hObject=0x1f0) returned 1 [0100.335] CloseHandle (hObject=0x1e8) returned 1 [0100.336] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.z49-css-qhb")) returned 0 [0100.337] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.z49-css-qhb")) returned 0x20 [0100.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 0x7e2908 [0100.337] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0100.337] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0100.337] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 1 [0100.339] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 0xffffffff [0100.339] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1 [0100.339] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="wordEtw.man", cAlternateFileName="")) returned 1 [0100.339] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0100.339] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0100.339] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30333738, dwReserved1=0x32392d32, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0100.339] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0100.340] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45383043, dwReserved1=0x322d3939, cFileName="Crypto", cAlternateFileName="")) returned 1 [0100.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77744564, dwReserved1=0x6e616d2e, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0100.340] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77744564, dwReserved1=0x6e616d2e, cFileName="..", cAlternateFileName="")) returned 1 [0100.340] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77744564, dwReserved1=0x6e616d2e, cFileName="DSS", cAlternateFileName="")) returned 1 [0100.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0100.340] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0100.340] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0100.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0100.391] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.391] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.391] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0100.391] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0100.391] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0100.391] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656e6968, dwReserved1=0x7379654b, cFileName="Keys", cAlternateFileName="")) returned 1 [0100.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0100.441] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0100.441] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0100.441] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0100.441] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656e6968, dwReserved1=0x7379654b, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0100.441] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0100.442] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0100.442] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0100.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0100.443] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.443] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.443] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0100.443] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0100.443] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0100.443] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x734b4941, cFileName="RSA", cAlternateFileName="")) returned 1 [0100.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0100.443] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0100.443] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20c, dwReserved1=0x40221d, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0100.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0100.450] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.450] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0100.450] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0100.451] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0100.453] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b1 [0100.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0100.453] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0100.748] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8b1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x8b1, lpOverlapped=0x0) returned 1 [0100.751] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8b1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x8b1, lpOverlapped=0x0) returned 1 [0100.752] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.832] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.946] CloseHandle (hObject=0x1f0) returned 1 [0100.946] CloseHandle (hObject=0x1f4) returned 1 [0101.008] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.008] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.009] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0x7e2688 [0101.009] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0101.009] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0101.009] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 1 [0101.010] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.010] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.011] CloseHandle (hObject=0xffffffff) returned 1 [0101.011] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.011] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.011] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="l!\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.011] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="l!\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.011] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.012] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.012] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.012] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.012] CloseHandle (hObject=0xffffffff) returned 1 [0101.012] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.012] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.013] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨.\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.013] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨.\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.013] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.013] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.013] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.013] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.013] CloseHandle (hObject=0xffffffff) returned 1 [0101.014] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.014] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.014] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.014] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.014] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.014] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.014] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.015] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.015] CloseHandle (hObject=0xffffffff) returned 1 [0101.015] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.015] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.015] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.015] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.015] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.015] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.016] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.016] CloseHandle (hObject=0xffffffff) returned 1 [0101.016] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.016] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.016] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.016] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.016] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.016] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.016] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.016] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.016] CloseHandle (hObject=0xffffffff) returned 1 [0101.016] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.017] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.017] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.017] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.017] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.017] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.017] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.017] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.017] CloseHandle (hObject=0xffffffff) returned 1 [0101.017] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.017] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.017] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.018] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.018] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.018] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.018] CloseHandle (hObject=0xffffffff) returned 1 [0101.018] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.019] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.019] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.019] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.019] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.019] CloseHandle (hObject=0xffffffff) returned 1 [0101.019] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.019] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.019] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c!\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.020] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c!\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.020] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.020] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.020] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.020] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.020] CloseHandle (hObject=0xffffffff) returned 1 [0101.020] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.020] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.021] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.021] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.021] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.021] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.021] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.021] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.021] CloseHandle (hObject=0xffffffff) returned 1 [0101.021] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.022] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.022] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.022] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.022] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.022] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.022] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.022] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.022] CloseHandle (hObject=0xffffffff) returned 1 [0101.022] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.023] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.023] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.023] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.023] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.023] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.023] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.023] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.023] CloseHandle (hObject=0xffffffff) returned 1 [0101.024] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.024] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.024] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.024] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.024] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.024] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.025] CloseHandle (hObject=0xffffffff) returned 1 [0101.025] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.025] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.025] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.025] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.025] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.025] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.025] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.026] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.026] CloseHandle (hObject=0xffffffff) returned 1 [0101.026] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.026] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.026] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="à-\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0101.026] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="à-\x07\x02Ø/\x07\x02(2@")) returned 0 [0101.026] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.026] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys")) returned 0 [0101.027] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.027] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0101.027] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0101.027] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63616136, dwReserved1=0x34393665, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0101.027] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0101.027] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0101.027] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1 [0101.027] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0101.027] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0101.096] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38 [0101.096] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0101.096] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0101.322] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x38, lpOverlapped=0x0) returned 1 [0101.323] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x38, lpOverlapped=0x0) returned 1 [0101.324] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.414] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.426] CloseHandle (hObject=0x1f4) returned 1 [0101.426] CloseHandle (hObject=0x1f0) returned 1 [0101.428] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.428] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0x7e2908 [0101.429] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0101.429] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0101.429] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 1 [0101.487] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.487] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.487] CloseHandle (hObject=0xffffffff) returned 1 [0101.487] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.487] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.487] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.488] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.488] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.488] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.488] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.488] CloseHandle (hObject=0xffffffff) returned 1 [0101.488] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.488] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.488] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.488] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.488] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.489] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.489] CloseHandle (hObject=0xffffffff) returned 1 [0101.489] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.489] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.489] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.489] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.489] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.489] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.490] CloseHandle (hObject=0xffffffff) returned 1 [0101.490] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.490] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.490] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.490] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.490] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.490] CloseHandle (hObject=0xffffffff) returned 1 [0101.490] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.491] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.491] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.491] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.491] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.491] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.491] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.491] CloseHandle (hObject=0xffffffff) returned 1 [0101.491] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.491] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.491] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.492] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.492] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.492] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.492] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.492] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.492] CloseHandle (hObject=0xffffffff) returned 1 [0101.492] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.492] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.492] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.492] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.492] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.492] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.493] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.493] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.493] CloseHandle (hObject=0xffffffff) returned 1 [0101.493] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.493] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.493] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.493] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.493] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.493] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.493] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.493] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.494] CloseHandle (hObject=0xffffffff) returned 1 [0101.494] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.494] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.494] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.494] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.494] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.494] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.494] CloseHandle (hObject=0xffffffff) returned 1 [0101.495] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.495] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.495] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.495] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.495] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.495] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.495] CloseHandle (hObject=0xffffffff) returned 1 [0101.495] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.496] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.496] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.496] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.496] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.496] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.496] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.496] CloseHandle (hObject=0xffffffff) returned 1 [0101.496] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.496] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.497] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è,\x07\x02\x98.\x07\x02(2@")) returned 0xffffffff [0101.497] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è,\x07\x02\x98.\x07\x02(2@")) returned 0 [0101.497] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.497] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.497] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.497] CloseHandle (hObject=0xffffffff) returned 1 [0101.497] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.498] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0101.498] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.498] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.498] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.498] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.498] CloseHandle (hObject=0xffffffff) returned 1 [0101.498] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.499] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0101.499] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.499] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.499] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.499] CloseHandle (hObject=0xffffffff) returned 1 [0101.499] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0101.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0101.499] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0101.499] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.500] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.500] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18")) returned 0 [0101.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0101.500] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0101.500] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0101.500] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63616136, dwReserved1=0x34393665, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0101.500] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0101.500] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x312d352d, dwReserved1=0x73796538, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0101.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30316463, dwReserved1=0x39366636, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0101.506] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30316463, dwReserved1=0x39366636, cFileName="..", cAlternateFileName="")) returned 1 [0101.506] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x30316463, dwReserved1=0x39366636, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1 [0101.506] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0101.506] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0101.506] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61d [0101.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0101.507] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0101.661] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x61d, lpOverlapped=0x0) returned 1 [0101.663] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x61d, lpOverlapped=0x0) returned 1 [0101.665] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.897] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.909] CloseHandle (hObject=0x1e8) returned 1 [0101.909] CloseHandle (hObject=0x1f0) returned 1 [0101.911] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.911] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.911] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 0x7e2688 [0101.911] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 0 [0101.911] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0101.912] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 1 [0101.913] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.913] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.913] CloseHandle (hObject=0xffffffff) returned 1 [0101.913] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.913] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.913] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.913] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ü/\x07\x02(2@")) returned 0 [0101.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.913] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.914] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.914] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.914] CloseHandle (hObject=0xffffffff) returned 1 [0101.914] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.914] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.914] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.914] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ü/\x07\x02(2@")) returned 0 [0101.914] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.914] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.914] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.915] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.915] CloseHandle (hObject=0xffffffff) returned 1 [0101.915] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.915] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.915] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.915] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ü/\x07\x02(2@")) returned 0 [0101.915] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.915] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.915] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.915] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.916] CloseHandle (hObject=0xffffffff) returned 1 [0101.916] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.916] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.916] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.916] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0 [0101.916] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.916] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.916] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.916] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.916] CloseHandle (hObject=0xffffffff) returned 1 [0101.916] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.917] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.917] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.917] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0 [0101.917] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.917] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.917] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.917] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.917] CloseHandle (hObject=0xffffffff) returned 1 [0101.918] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.918] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.918] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.918] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0 [0101.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.918] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.918] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.918] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.918] CloseHandle (hObject=0xffffffff) returned 1 [0101.919] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.919] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.919] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.919] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð-\x07\x02ü/\x07\x02(2@")) returned 0 [0101.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.919] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.919] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.919] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.919] CloseHandle (hObject=0xffffffff) returned 1 [0101.919] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.920] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="à-\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.920] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="à-\x07\x02ü/\x07\x02(2@")) returned 0 [0101.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.920] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.920] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.920] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.920] CloseHandle (hObject=0xffffffff) returned 1 [0101.920] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.920] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð-\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.921] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð-\x07\x02ü/\x07\x02(2@")) returned 0 [0101.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.921] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.921] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.921] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.921] CloseHandle (hObject=0xffffffff) returned 1 [0101.921] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.921] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.921] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0101.921] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.922] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.922] CloseHandle (hObject=0xffffffff) returned 1 [0101.922] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.922] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.922] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02ü/\x07\x02(2@")) returned 0 [0101.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.922] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.923] CloseHandle (hObject=0xffffffff) returned 1 [0101.923] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.923] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.923] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" .\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.923] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" .\x07\x02ü/\x07\x02(2@")) returned 0 [0101.923] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.923] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.923] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.924] CloseHandle (hObject=0xffffffff) returned 1 [0101.924] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.924] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.924] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="0.\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.924] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="0.\x07\x02ü/\x07\x02(2@")) returned 0 [0101.924] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.924] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.924] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.924] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.925] CloseHandle (hObject=0xffffffff) returned 1 [0101.925] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.925] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.925] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="@.\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.925] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="@.\x07\x02ü/\x07\x02(2@")) returned 0 [0101.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.925] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.925] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.925] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.926] CloseHandle (hObject=0xffffffff) returned 1 [0101.926] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0 [0101.926] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.z49-css-qhb")) returned 0x20 [0101.926] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="P.\x07\x02ü/\x07\x02(2@")) returned 0xffffffff [0101.926] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="P.\x07\x02ü/\x07\x02(2@")) returned 0 [0101.926] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.926] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0101.926] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0xffffffff [0101.926] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1 [0101.926] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0101.927] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0101.927] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61d [0101.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0101.927] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0102.158] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x61d, lpOverlapped=0x0) returned 1 [0102.555] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x61d, lpOverlapped=0x0) returned 1 [0102.556] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.582] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.593] CloseHandle (hObject=0x1f0) returned 1 [0102.593] CloseHandle (hObject=0x1e8) returned 1 [0102.594] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.595] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.595] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0x7e2848 [0102.595] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0102.595] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0102.595] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 1 [0102.596] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.596] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.596] CloseHandle (hObject=0xffffffff) returned 1 [0102.596] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.597] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.597] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0 [0102.597] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.597] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.597] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.597] CloseHandle (hObject=0xffffffff) returned 1 [0102.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.597] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.598] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0 [0102.598] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.598] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.598] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.598] CloseHandle (hObject=0xffffffff) returned 1 [0102.598] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.598] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0 [0102.598] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.598] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.599] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.599] CloseHandle (hObject=0xffffffff) returned 1 [0102.599] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.599] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|-\x07\x02(2@")) returned 0 [0102.599] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.599] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.599] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.599] CloseHandle (hObject=0xffffffff) returned 1 [0102.600] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.600] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0 [0102.600] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.600] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.600] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.600] CloseHandle (hObject=0xffffffff) returned 1 [0102.600] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.601] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0 [0102.601] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.601] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.601] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.601] CloseHandle (hObject=0xffffffff) returned 1 [0102.601] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.657] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0 [0102.657] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.657] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.657] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.657] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.657] CloseHandle (hObject=0xffffffff) returned 1 [0102.657] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.658] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.658] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.658] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T.\x07\x02|-\x07\x02(2@")) returned 0 [0102.658] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.658] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.658] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.658] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.658] CloseHandle (hObject=0xffffffff) returned 1 [0102.658] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.658] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.659] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="d.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.659] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="d.\x07\x02|-\x07\x02(2@")) returned 0 [0102.659] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.659] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.659] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.659] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.659] CloseHandle (hObject=0xffffffff) returned 1 [0102.659] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.659] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="t.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.660] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="t.\x07\x02|-\x07\x02(2@")) returned 0 [0102.660] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.660] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.660] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.660] CloseHandle (hObject=0xffffffff) returned 1 [0102.660] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.661] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84.\x07\x02|-\x07\x02(2@")) returned 0 [0102.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.661] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.661] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.661] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.661] CloseHandle (hObject=0xffffffff) returned 1 [0102.661] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.661] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.661] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.661] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94.\x07\x02|-\x07\x02(2@")) returned 0 [0102.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.661] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.661] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.662] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.662] CloseHandle (hObject=0xffffffff) returned 1 [0102.662] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.662] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.662] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¤.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.662] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¤.\x07\x02|-\x07\x02(2@")) returned 0 [0102.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.662] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.662] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.662] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.662] CloseHandle (hObject=0xffffffff) returned 1 [0102.663] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.663] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.663] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.663] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´.\x07\x02|-\x07\x02(2@")) returned 0 [0102.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.663] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.663] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.663] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.663] CloseHandle (hObject=0xffffffff) returned 1 [0102.663] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0 [0102.663] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.z49-css-qhb")) returned 0x20 [0102.664] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä.\x07\x02|-\x07\x02(2@")) returned 0xffffffff [0102.664] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d9de0, ftLastAccessTime.dwHighDateTime=0x22, ftLastWriteTime.dwLowDateTime=0x7d0288, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä.\x07\x02|-\x07\x02(2@")) returned 0 [0102.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0102.664] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys")) returned 0 [0102.664] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0xffffffff [0102.664] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0102.664] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0102.664] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x312d352d, dwReserved1=0x73796538, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0102.664] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0102.664] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4b6d6574, dwReserved1=0x32737965, cFileName="DataMart", cAlternateFileName="")) returned 1 [0102.665] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0102.665] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName="..", cAlternateFileName="")) returned 1 [0102.665] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0102.665] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0102.666] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0102.666] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0102.666] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0102.666] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0102.666] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0102.666] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46695764, dwReserved1=0x32737969, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0102.666] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0102.666] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName="..", cAlternateFileName="")) returned 1 [0102.666] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37653964, dwReserved1=0x63643164, cFileName="Device", cAlternateFileName="")) returned 1 [0102.666] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0102.667] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0102.667] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0102.667] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0102.668] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0102.669] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="background.png", cAlternateFileName="")) returned 1 [0102.669] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0102.670] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0102.671] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0102.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0102.672] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0102.956] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1fad1, lpOverlapped=0x0) returned 1 [0102.998] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1fad1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1fad1, lpOverlapped=0x0) returned 1 [0103.001] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.027] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.075] CloseHandle (hObject=0x1f0) returned 1 [0103.075] CloseHandle (hObject=0x1f4) returned 1 [0103.079] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.z49-css-qhb")) returned 0 [0103.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.z49-css-qhb")) returned 0x20 [0103.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="background.png", cAlternateFileName="")) returned 0x7e2b48 [0103.080] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="background.png", cAlternateFileName="")) returned 0 [0103.080] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0103.080] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0103.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0103.080] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0103.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0103.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0103.083] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb61 [0103.083] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0103.083] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0103.187] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb61, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xb61, lpOverlapped=0x0) returned 1 [0103.243] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb61, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xb61, lpOverlapped=0x0) returned 1 [0103.245] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.277] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.351] CloseHandle (hObject=0x1f4) returned 1 [0103.351] CloseHandle (hObject=0x1f0) returned 1 [0103.353] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.z49-css-qhb")) returned 0 [0103.353] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.z49-css-qhb")) returned 0x20 [0103.353] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="behavior.xml", cAlternateFileName="")) returned 0x7e2648 [0103.353] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0103.353] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0103.354] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0 [0103.354] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0103.354] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="device.png", cAlternateFileName="")) returned 1 [0103.354] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0103.356] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0103.357] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadc8 [0103.357] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0103.357] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0103.541] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xadc8, lpOverlapped=0x0) returned 1 [0103.544] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xadc8, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xadc8, lpOverlapped=0x0) returned 1 [0103.546] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.624] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.639] CloseHandle (hObject=0x1f0) returned 1 [0103.639] CloseHandle (hObject=0x1f4) returned 1 [0103.641] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.z49-css-qhb")) returned 0 [0103.642] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.z49-css-qhb")) returned 0x20 [0103.642] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="device.png", cAlternateFileName="")) returned 0x7e2a88 [0103.642] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="device.png", cAlternateFileName="")) returned 0 [0103.642] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0103.642] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0 [0103.642] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0103.643] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0103.643] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0103.654] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0103.655] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0103.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0103.655] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0103.956] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x70c1, lpOverlapped=0x0) returned 1 [0103.959] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x70c1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x70c1, lpOverlapped=0x0) returned 1 [0103.961] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.036] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.054] CloseHandle (hObject=0x1f4) returned 1 [0104.054] CloseHandle (hObject=0x1f0) returned 1 [0104.056] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.z49-css-qhb")) returned 0 [0104.056] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.z49-css-qhb")) returned 0x20 [0104.056] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="overlay.png", cAlternateFileName="")) returned 0x7e2888 [0104.056] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="overlay.png", cAlternateFileName="")) returned 0 [0104.056] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0104.056] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0 [0104.056] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0104.057] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0104.057] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0104.058] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0104.059] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99d3 [0104.059] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0104.059] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0104.291] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x99d3, lpOverlapped=0x0) returned 1 [0104.294] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x99d3, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x99d3, lpOverlapped=0x0) returned 1 [0104.295] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.372] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.388] CloseHandle (hObject=0x1f0) returned 1 [0104.388] CloseHandle (hObject=0x1f4) returned 1 [0104.391] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.z49-css-qhb")) returned 0 [0104.391] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.z49-css-qhb")) returned 0x20 [0104.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="superbar.png", cAlternateFileName="")) returned 0x7e2c48 [0104.391] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0104.391] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0104.391] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0 [0104.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0104.392] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0104.392] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0104.392] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61627265, dwReserved1=0x6e702e72, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0104.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0104.392] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0104.392] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="background.png", cAlternateFileName="")) returned 1 [0104.393] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0104.447] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0104.450] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0104.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0104.450] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0104.577] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1fad1, lpOverlapped=0x0) returned 1 [0104.623] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1fad1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1fad1, lpOverlapped=0x0) returned 1 [0104.635] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.662] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.726] CloseHandle (hObject=0x1f4) returned 1 [0104.726] CloseHandle (hObject=0x1f0) returned 1 [0104.843] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.z49-css-qhb")) returned 0 [0104.844] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.z49-css-qhb")) returned 0x20 [0104.844] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="background.png", cAlternateFileName="")) returned 0x7e2848 [0104.844] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="background.png", cAlternateFileName="")) returned 0 [0104.844] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0104.844] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0104.844] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0104.845] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x60, dwReserved1=0x40221d, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0104.845] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0104.845] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0104.845] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cf [0104.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0104.846] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0105.036] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6cf, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x6cf, lpOverlapped=0x0) returned 1 [0105.038] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6cf, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x6cf, lpOverlapped=0x0) returned 1 [0105.039] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.114] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.130] CloseHandle (hObject=0x1f0) returned 1 [0105.130] CloseHandle (hObject=0x1f4) returned 1 [0105.131] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.z49-css-qhb")) returned 0 [0105.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.z49-css-qhb")) returned 0x20 [0105.132] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="behavior.xml", cAlternateFileName="")) returned 0x7e2bc8 [0105.132] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0105.132] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0105.132] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0 [0105.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0105.132] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x60, dwReserved1=0x40221d, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0105.133] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0105.133] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0105.168] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0105.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0105.169] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0105.305] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x70c1, lpOverlapped=0x0) returned 1 [0105.394] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x70c1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x70c1, lpOverlapped=0x0) returned 1 [0105.396] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.427] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.545] CloseHandle (hObject=0x1f4) returned 1 [0105.545] CloseHandle (hObject=0x1f0) returned 1 [0105.547] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.z49-css-qhb")) returned 0 [0105.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.z49-css-qhb")) returned 0x20 [0105.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="watermark.png", cAlternateFileName="")) returned 0x7e2708 [0105.547] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0105.548] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0105.548] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0 [0105.548] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0105.548] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x60, dwReserved1=0x40221d, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0105.548] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0105.548] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61627265, dwReserved1=0x6e702e72, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0105.548] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0105.549] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38643230, dwReserved1=0x352d3731, cFileName="Task", cAlternateFileName="")) returned 1 [0105.549] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d7265, dwReserved1=0x702e6b72, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0105.549] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d7265, dwReserved1=0x702e6b72, cFileName="..", cAlternateFileName="")) returned 1 [0105.549] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d7265, dwReserved1=0x702e6b72, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0105.549] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0105.566] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0105.566] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x40221d, cFileName="en-US", cAlternateFileName="")) returned 1 [0105.566] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0105.567] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0105.567] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0105.567] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0105.570] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0105.571] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0105.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0105.571] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0105.864] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x536, lpOverlapped=0x0) returned 1 [0105.866] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x536, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x536, lpOverlapped=0x0) returned 1 [0105.867] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.894] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.944] CloseHandle (hObject=0x1f4) returned 1 [0105.944] CloseHandle (hObject=0x1f8) returned 1 [0105.945] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.z49-css-qhb")) returned 0 [0105.946] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.z49-css-qhb")) returned 0x20 [0105.946] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="resource.xml", cAlternateFileName="")) returned 0x7e2608 [0105.946] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0105.946] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0105.946] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0 [0105.947] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0105.947] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0105.947] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0105.947] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x6372756f, dwReserved1=0x6d782e65, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0105.947] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0105.950] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0105.951] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0105.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0105.951] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0106.117] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xd0a3, lpOverlapped=0x0) returned 1 [0106.138] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd0a3, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xd0a3, lpOverlapped=0x0) returned 1 [0106.140] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.207] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.236] CloseHandle (hObject=0x1f0) returned 1 [0106.236] CloseHandle (hObject=0x1f8) returned 1 [0106.239] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.z49-css-qhb")) returned 0 [0106.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.z49-css-qhb")) returned 0x20 [0106.239] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="folder.ico", cAlternateFileName="")) returned 0x7e2848 [0106.239] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0106.240] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0106.240] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0 [0106.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20 [0106.240] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0106.240] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0106.242] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0106.242] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72ee [0106.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0106.242] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0106.422] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x72ee, lpOverlapped=0x0) returned 1 [0106.425] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x72ee, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x72ee, lpOverlapped=0x0) returned 1 [0106.427] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.503] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.519] CloseHandle (hObject=0x1f8) returned 1 [0106.519] CloseHandle (hObject=0x1f0) returned 1 [0106.521] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.z49-css-qhb")) returned 0 [0106.522] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.z49-css-qhb")) returned 0x20 [0106.522] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="netfol.ico", cAlternateFileName="")) returned 0x7e2a48 [0106.522] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="netfol.ico", cAlternateFileName="")) returned 0 [0106.522] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0106.522] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0 [0106.522] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20 [0106.523] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0106.523] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0106.523] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0106.523] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14668 [0106.523] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0106.524] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0107.006] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x14668, lpOverlapped=0x0) returned 1 [0107.010] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x14668, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x14668, lpOverlapped=0x0) returned 1 [0107.012] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.093] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.105] CloseHandle (hObject=0x1f0) returned 1 [0107.106] CloseHandle (hObject=0x1f8) returned 1 [0107.110] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.z49-css-qhb")) returned 0 [0107.111] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.z49-css-qhb")) returned 0x20 [0107.111] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="pictures.ico", cAlternateFileName="")) returned 0x7e2a48 [0107.111] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="pictures.ico", cAlternateFileName="")) returned 0 [0107.111] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0107.111] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0 [0107.111] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20 [0107.112] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0107.112] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0107.112] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0107.113] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0107.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0107.113] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0107.296] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x536, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x536, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x536, lpOverlapped=0x0) returned 1 [0107.302] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.383] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.399] CloseHandle (hObject=0x1f8) returned 1 [0107.399] CloseHandle (hObject=0x1f0) returned 1 [0107.494] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.z49-css-qhb")) returned 0 [0107.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.z49-css-qhb")) returned 0x20 [0107.495] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="resource.xml", cAlternateFileName="")) returned 0x7e2888 [0107.495] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0107.495] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0107.495] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0 [0107.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0107.495] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0107.495] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0107.496] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0107.497] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcaa9 [0107.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0107.497] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0107.642] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xcaa9, lpOverlapped=0x0) returned 1 [0107.645] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xcaa9, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xcaa9, lpOverlapped=0x0) returned 1 [0107.647] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.720] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.841] CloseHandle (hObject=0x1f0) returned 1 [0107.841] CloseHandle (hObject=0x1f8) returned 1 [0107.847] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.z49-css-qhb")) returned 0 [0107.848] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.z49-css-qhb")) returned 0x20 [0107.848] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="ringtones.ico", cAlternateFileName="")) returned 0x7e2a48 [0107.848] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="ringtones.ico", cAlternateFileName="")) returned 0 [0107.848] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0107.848] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0 [0107.849] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20 [0107.849] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0107.849] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0107.891] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0107.892] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10850 [0107.892] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0107.893] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0108.266] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x10850, lpOverlapped=0x0) returned 1 [0108.270] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10850, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x10850, lpOverlapped=0x0) returned 1 [0108.272] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.404] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.420] CloseHandle (hObject=0x1f8) returned 1 [0108.420] CloseHandle (hObject=0x1f0) returned 1 [0108.427] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.z49-css-qhb")) returned 0 [0108.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.z49-css-qhb")) returned 0x20 [0108.428] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="settings.ico", cAlternateFileName="")) returned 0x7e2608 [0108.428] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="settings.ico", cAlternateFileName="")) returned 0 [0108.428] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0108.428] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0 [0108.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20 [0108.429] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0108.429] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0108.429] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0108.429] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc04b [0108.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0108.430] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0108.647] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xc04b, lpOverlapped=0x0) returned 1 [0108.650] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc04b, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xc04b, lpOverlapped=0x0) returned 1 [0108.652] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.725] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.741] CloseHandle (hObject=0x1f0) returned 1 [0108.742] CloseHandle (hObject=0x1f8) returned 1 [0108.857] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.z49-css-qhb")) returned 0 [0108.857] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.z49-css-qhb")) returned 0x20 [0108.858] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="sync.ico", cAlternateFileName="")) returned 0x7e2608 [0108.858] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="sync.ico", cAlternateFileName="")) returned 0 [0108.858] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0108.858] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0 [0108.858] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20 [0108.858] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0108.859] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0108.902] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0108.902] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2aff [0108.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0108.903] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0109.022] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2aff, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x2aff, lpOverlapped=0x0) returned 1 [0109.025] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2aff, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x2aff, lpOverlapped=0x0) returned 1 [0109.027] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.104] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.119] CloseHandle (hObject=0x1f8) returned 1 [0109.119] CloseHandle (hObject=0x1f0) returned 1 [0109.121] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.z49-css-qhb")) returned 0 [0109.121] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.z49-css-qhb")) returned 0x20 [0109.121] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="tasks.xml", cAlternateFileName="")) returned 0x7e2548 [0109.121] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0109.121] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0109.122] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0 [0109.122] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0109.122] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0109.122] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0109.122] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0109.192] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b9f4 [0109.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0109.192] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0109.431] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1b9f4, lpOverlapped=0x0) returned 1 [0109.448] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1b9f4, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1b9f4, lpOverlapped=0x0) returned 1 [0109.452] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.530] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.546] CloseHandle (hObject=0x1f0) returned 1 [0109.547] CloseHandle (hObject=0x1f8) returned 1 [0109.552] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.z49-css-qhb")) returned 0 [0109.552] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.z49-css-qhb")) returned 0x20 [0109.552] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="wmp.ico", cAlternateFileName="")) returned 0x7e2c48 [0109.553] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0109.553] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0109.553] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0 [0109.553] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20 [0109.553] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0109.553] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0109.554] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f63692e, dwReserved1=0x63696c6d, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0109.554] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0109.616] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0109.616] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.616] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0109.617] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0109.617] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0109.617] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0109.617] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0109.618] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e8 [0109.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0109.618] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0109.922] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5e8, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x5e8, lpOverlapped=0x0) returned 1 [0109.924] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5e8, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x5e8, lpOverlapped=0x0) returned 1 [0109.925] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.951] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.005] CloseHandle (hObject=0x1f0) returned 1 [0110.005] CloseHandle (hObject=0x1f4) returned 1 [0110.006] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.z49-css-qhb")) returned 0 [0110.006] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.z49-css-qhb")) returned 0x20 [0110.006] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="resource.xml", cAlternateFileName="")) returned 0x7e2848 [0110.007] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0110.007] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0110.007] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0 [0110.007] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20 [0110.007] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0110.007] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0110.007] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x6372756f, dwReserved1=0x6d782e65, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0110.007] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0110.008] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0110.008] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0110.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0110.008] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0110.195] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xd0a3, lpOverlapped=0x0) returned 1 [0110.209] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd0a3, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xd0a3, lpOverlapped=0x0) returned 1 [0110.211] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.289] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.302] CloseHandle (hObject=0x1f8) returned 1 [0110.302] CloseHandle (hObject=0x1f4) returned 1 [0110.303] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.z49-css-qhb")) returned 0 [0110.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.z49-css-qhb")) returned 0x20 [0110.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="folder.ico", cAlternateFileName="")) returned 0x7e2a48 [0110.304] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0110.304] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0110.304] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0 [0110.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20 [0110.304] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0110.304] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0110.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0110.305] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3c8 [0110.305] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0110.305] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0110.597] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xe3c8, lpOverlapped=0x0) returned 1 [0110.602] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe3c8, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xe3c8, lpOverlapped=0x0) returned 1 [0110.611] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.695] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.710] CloseHandle (hObject=0x1f4) returned 1 [0110.711] CloseHandle (hObject=0x1f8) returned 1 [0110.713] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.z49-css-qhb")) returned 0 [0110.713] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.z49-css-qhb")) returned 0x20 [0110.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="print_pref.ico", cAlternateFileName="")) returned 0x7e2608 [0110.714] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="print_pref.ico", cAlternateFileName="")) returned 0 [0110.714] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0110.714] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0 [0110.714] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20 [0110.714] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0110.715] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0110.715] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0110.715] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xebb8 [0110.715] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0110.716] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0110.992] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xebb8, lpOverlapped=0x0) returned 1 [0110.995] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xebb8, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xebb8, lpOverlapped=0x0) returned 1 [0110.998] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.075] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.096] CloseHandle (hObject=0x1f8) returned 1 [0111.096] CloseHandle (hObject=0x1f4) returned 1 [0111.103] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.z49-css-qhb")) returned 0 [0111.103] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.z49-css-qhb")) returned 0x20 [0111.103] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="print_property.ico", cAlternateFileName="")) returned 0x7e2b48 [0111.104] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="print_property.ico", cAlternateFileName="")) returned 0 [0111.104] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0111.104] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0 [0111.104] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20 [0111.104] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0111.104] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0111.105] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0111.142] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff5 [0111.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0111.142] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0111.494] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xdff5, lpOverlapped=0x0) returned 1 [0111.497] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdff5, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xdff5, lpOverlapped=0x0) returned 1 [0111.500] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0111.619] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.691] CloseHandle (hObject=0x1f4) returned 1 [0111.692] CloseHandle (hObject=0x1f8) returned 1 [0111.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.z49-css-qhb")) returned 0 [0111.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.z49-css-qhb")) returned 0x20 [0111.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="print_queue.ico", cAlternateFileName="")) returned 0x7e2908 [0111.695] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="print_queue.ico", cAlternateFileName="")) returned 0 [0111.695] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0111.696] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0 [0111.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20 [0111.696] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0111.696] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0111.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0111.721] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec75 [0111.721] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0111.722] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0112.081] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xec75, lpOverlapped=0x0) returned 1 [0112.084] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xec75, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xec75, lpOverlapped=0x0) returned 1 [0112.088] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.178] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.194] CloseHandle (hObject=0x1f8) returned 1 [0112.194] CloseHandle (hObject=0x1f4) returned 1 [0112.197] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.z49-css-qhb")) returned 0 [0112.197] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.z49-css-qhb")) returned 0x20 [0112.197] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="scan_.ico", cAlternateFileName="")) returned 0x7e2ac8 [0112.197] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="scan_.ico", cAlternateFileName="")) returned 0 [0112.197] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0112.198] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0 [0112.198] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20 [0112.198] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0112.198] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0112.198] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0112.199] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10654 [0112.199] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0112.199] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0112.596] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x10654, lpOverlapped=0x0) returned 1 [0112.612] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10654, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x10654, lpOverlapped=0x0) returned 1 [0112.616] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0112.900] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.930] CloseHandle (hObject=0x1f4) returned 1 [0112.930] CloseHandle (hObject=0x1f8) returned 1 [0112.935] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.z49-css-qhb")) returned 0 [0112.935] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.z49-css-qhb")) returned 0x20 [0112.935] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="scan_property.ico", cAlternateFileName="")) returned 0x7e2848 [0112.935] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="scan_property.ico", cAlternateFileName="")) returned 0 [0112.936] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0112.936] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0 [0112.936] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20 [0112.936] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0112.936] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0112.936] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0113.006] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8c2 [0113.006] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0113.007] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0113.243] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xf8c2, lpOverlapped=0x0) returned 1 [0113.282] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xf8c2, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xf8c2, lpOverlapped=0x0) returned 1 [0113.285] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.381] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.400] CloseHandle (hObject=0x1f8) returned 1 [0113.400] CloseHandle (hObject=0x1f4) returned 1 [0113.406] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.z49-css-qhb")) returned 0 [0113.407] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.z49-css-qhb")) returned 0x20 [0113.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0x7e2bc8 [0113.407] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0 [0113.407] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0113.408] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0 [0113.408] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20 [0113.408] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0113.408] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0113.409] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0113.409] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c64 [0113.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0113.409] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0113.725] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x2c64, lpOverlapped=0x0) returned 1 [0113.860] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2c64, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x2c64, lpOverlapped=0x0) returned 1 [0113.862] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0113.996] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.067] CloseHandle (hObject=0x1f4) returned 1 [0114.068] CloseHandle (hObject=0x1f8) returned 1 [0114.071] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.z49-css-qhb")) returned 0 [0114.071] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.z49-css-qhb")) returned 0x20 [0114.071] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="tasks.xml", cAlternateFileName="")) returned 0x7e2848 [0114.072] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0114.072] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.072] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0 [0114.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20 [0114.072] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0114.072] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0114.073] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f63692e, dwReserved1=0x63696c6d, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0114.073] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0114.073] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38643230, dwReserved1=0x352d3731, cFileName="Task", cAlternateFileName="")) returned 0 [0114.073] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0114.073] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4665636b, dwReserved1=0x32737969, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0114.073] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0114.075] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName="..", cAlternateFileName="")) returned 1 [0114.075] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName="..", cAlternateFileName="")) returned 0 [0114.075] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.078] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4665636b, dwReserved1=0x32737969, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0114.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0114.080] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName="..", cAlternateFileName="")) returned 1 [0114.080] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1 [0114.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0114.081] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName="..", cAlternateFileName="")) returned 1 [0114.081] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName="..", cAlternateFileName="")) returned 0 [0114.081] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.081] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34656235, dwReserved1=0x662d6432, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1 [0114.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0114.081] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName="..", cAlternateFileName="")) returned 1 [0114.081] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1 [0114.081] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x782e736b, dwReserved1=0x6e696c6d, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0 [0114.081] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.082] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x6669752e, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1 [0114.082] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0114.084] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.084] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1 [0114.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.126] CloseHandle (hObject=0xffffffff) returned 1 [0114.126] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.z49-css-qhb")) returned 0 [0114.126] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.z49-css-qhb")) returned 0xffffffff [0114.127] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 0x7e2688 [0114.127] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 0 [0114.127] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0114.127] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 1 [0114.128] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 0xffffffff [0114.128] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1 [0114.128] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x121c, dwReserved1=0x40221d, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1 [0114.128] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.131] CloseHandle (hObject=0xffffffff) returned 1 [0114.131] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json.z49-css-qhb")) returned 0 [0114.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json.z49-css-qhb")) returned 0xffffffff [0114.131] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 0x7e2b88 [0114.131] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 0 [0114.131] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0114.132] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json")) returned 1 [0114.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json")) returned 0xffffffff [0114.132] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x8c, dwReserved1=0x40221d, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1 [0114.133] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.133] CloseHandle (hObject=0xffffffff) returned 1 [0114.133] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.z49-css-qhb")) returned 0 [0114.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.z49-css-qhb")) returned 0xffffffff [0114.133] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 0x7e2688 [0114.134] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 0 [0114.134] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0114.134] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json")) returned 1 [0114.134] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json")) returned 0xffffffff [0114.135] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1 [0114.135] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.135] CloseHandle (hObject=0xffffffff) returned 1 [0114.135] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json.z49-css-qhb")) returned 0 [0114.135] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json.z49-css-qhb")) returned 0xffffffff [0114.135] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 0x7e2ac8 [0114.136] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 0 [0114.136] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0114.136] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json")) returned 1 [0114.137] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json")) returned 0xffffffff [0114.137] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x1080, dwReserved1=0x40221d, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1 [0114.137] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.137] CloseHandle (hObject=0xffffffff) returned 1 [0114.137] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.z49-css-qhb")) returned 0 [0114.137] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.z49-css-qhb")) returned 0xffffffff [0114.137] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 0x7e2c08 [0114.138] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 0 [0114.138] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0114.138] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json")) returned 1 [0114.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json")) returned 0xffffffff [0114.139] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1 [0114.139] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.141] CloseHandle (hObject=0xffffffff) returned 1 [0114.141] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.z49-css-qhb")) returned 0 [0114.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.z49-css-qhb")) returned 0xffffffff [0114.142] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x5c, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 0x7e2848 [0114.142] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x5c, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 0 [0114.142] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.142] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 1 [0114.143] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 0xffffffff [0114.143] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x8c, dwReserved1=0x40221d, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1 [0114.143] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1 [0114.143] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.143] CloseHandle (hObject=0xffffffff) returned 1 [0114.144] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json.z49-css-qhb")) returned 0 [0114.144] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json.z49-css-qhb")) returned 0xffffffff [0114.144] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x5c, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0x7e2648 [0114.144] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x5c, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0 [0114.144] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0114.144] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json")) returned 1 [0114.145] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json")) returned 0xffffffff [0114.145] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0 [0114.145] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0114.145] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265632e, dwReserved1=0x736a2e74, cFileName="ETLLogs", cAlternateFileName="")) returned 1 [0114.145] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0114.149] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.149] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1 [0114.149] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0114.149] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.149] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xd37711f2, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0114.150] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xd37711f2, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0114.150] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0114.150] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f4c6f, dwReserved1=0x2d726567, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1 [0114.150] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0114.150] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.150] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0114.150] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0114.151] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f4c6f, dwReserved1=0x2d726567, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1 [0114.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0114.152] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.152] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0114.152] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0114.152] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0114.152] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f4c6f, dwReserved1=0x2d726567, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0 [0114.153] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0114.153] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x776f6474, dwReserved1=0x676f4c6e, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1 [0114.153] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1 [0114.153] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1 [0114.153] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1 [0114.153] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1 [0114.153] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f4c6f, dwReserved1=0x2d726567, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0114.154] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f4c6f, dwReserved1=0x2d726567, cFileName="..", cAlternateFileName="")) returned 1 [0114.154] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f4c6f, dwReserved1=0x2d726567, cFileName="..", cAlternateFileName="")) returned 0 [0114.154] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0114.154] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="osver.txt", cAlternateFileName="")) returned 1 [0114.154] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.154] CloseHandle (hObject=0xffffffff) returned 1 [0114.155] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt.z49-css-qhb")) returned 0 [0114.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt.z49-css-qhb")) returned 0xffffffff [0114.155] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="osver.txt", cAlternateFileName="")) returned 0x7e2a48 [0114.155] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="osver.txt", cAlternateFileName="")) returned 0 [0114.155] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.155] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt")) returned 1 [0114.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt")) returned 0xffffffff [0114.156] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="parse.dat", cAlternateFileName="")) returned 1 [0114.156] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.157] CloseHandle (hObject=0xffffffff) returned 1 [0114.157] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat.z49-css-qhb")) returned 0 [0114.157] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat.z49-css-qhb")) returned 0xffffffff [0114.157] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="parse.dat", cAlternateFileName="")) returned 0x7e2648 [0114.157] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="parse.dat", cAlternateFileName="")) returned 0 [0114.157] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0114.158] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat")) returned 1 [0114.158] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat")) returned 0xffffffff [0114.158] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Sideload", cAlternateFileName="")) returned 1 [0114.158] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0114.159] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.159] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.159] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0114.159] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Siufloc", cAlternateFileName="")) returned 1 [0114.159] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0114.159] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.159] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.159] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.159] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1 [0114.159] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0114.207] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.208] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1 [0114.208] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.208] CloseHandle (hObject=0xffffffff) returned 1 [0114.209] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml.z49-css-qhb")) returned 0 [0114.209] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml.z49-css-qhb")) returned 0xffffffff [0114.209] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 0x7e2708 [0114.209] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 0 [0114.209] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0114.209] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml")) returned 1 [0114.210] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml")) returned 0xffffffff [0114.210] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1 [0114.210] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.211] CloseHandle (hObject=0xffffffff) returned 1 [0114.211] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml.z49-css-qhb")) returned 0 [0114.211] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.212] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 0x7e2a48 [0114.212] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 0 [0114.212] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.212] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml")) returned 1 [0114.212] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml")) returned 0xffffffff [0114.212] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1 [0114.213] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.213] CloseHandle (hObject=0xffffffff) returned 1 [0114.213] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml.z49-css-qhb")) returned 0 [0114.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml.z49-css-qhb")) returned 0xffffffff [0114.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 0x7e2a48 [0114.213] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 0 [0114.213] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.213] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml")) returned 1 [0114.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml")) returned 0xffffffff [0114.214] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1 [0114.214] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.214] CloseHandle (hObject=0xffffffff) returned 1 [0114.214] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml.z49-css-qhb")) returned 0 [0114.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.214] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 0x7e2bc8 [0114.215] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 0 [0114.215] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0114.215] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml")) returned 1 [0114.215] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml")) returned 0xffffffff [0114.215] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1 [0114.216] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.216] CloseHandle (hObject=0xffffffff) returned 1 [0114.217] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml.z49-css-qhb")) returned 0 [0114.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml.z49-css-qhb")) returned 0xffffffff [0114.217] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 0x7e2a48 [0114.217] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 0 [0114.217] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.217] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml")) returned 1 [0114.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml")) returned 0xffffffff [0114.232] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1 [0114.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.232] CloseHandle (hObject=0xffffffff) returned 1 [0114.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml.z49-css-qhb")) returned 0 [0114.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 0x7e2a48 [0114.233] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 0 [0114.233] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.233] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml")) returned 1 [0114.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml")) returned 0xffffffff [0114.234] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1 [0114.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.235] CloseHandle (hObject=0xffffffff) returned 1 [0114.235] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml.z49-css-qhb")) returned 0 [0114.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml.z49-css-qhb")) returned 0xffffffff [0114.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 0x7e2648 [0114.235] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 0 [0114.235] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0114.236] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml")) returned 1 [0114.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml")) returned 0xffffffff [0114.236] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1 [0114.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.237] CloseHandle (hObject=0xffffffff) returned 1 [0114.237] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml.z49-css-qhb")) returned 0 [0114.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.237] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 0x7e2c08 [0114.237] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 0 [0114.238] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0114.238] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml")) returned 1 [0114.238] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml")) returned 0xffffffff [0114.238] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1 [0114.238] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.240] CloseHandle (hObject=0xffffffff) returned 1 [0114.240] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml.z49-css-qhb")) returned 0 [0114.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml.z49-css-qhb")) returned 0xffffffff [0114.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 0x7e2bc8 [0114.241] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 0 [0114.241] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0114.241] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml")) returned 1 [0114.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml")) returned 0xffffffff [0114.242] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1 [0114.242] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.242] CloseHandle (hObject=0xffffffff) returned 1 [0114.242] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml.z49-css-qhb")) returned 0 [0114.242] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.242] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 0x7e2b08 [0114.243] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 0 [0114.243] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0114.243] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml")) returned 1 [0114.243] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml")) returned 0xffffffff [0114.244] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1 [0114.244] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.244] CloseHandle (hObject=0xffffffff) returned 1 [0114.244] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml.z49-css-qhb")) returned 0 [0114.244] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml.z49-css-qhb")) returned 0xffffffff [0114.244] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 0x7e2648 [0114.245] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 0 [0114.245] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0114.245] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml")) returned 1 [0114.245] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml")) returned 0xffffffff [0114.245] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1 [0114.246] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.246] CloseHandle (hObject=0xffffffff) returned 1 [0114.246] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml.z49-css-qhb")) returned 0 [0114.246] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 0x7e2b08 [0114.246] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 0 [0114.247] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0114.247] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml")) returned 1 [0114.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml")) returned 0xffffffff [0114.247] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1 [0114.247] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.249] CloseHandle (hObject=0xffffffff) returned 1 [0114.249] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml.z49-css-qhb")) returned 0 [0114.249] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml.z49-css-qhb")) returned 0xffffffff [0114.249] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 0x7e2a48 [0114.249] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 0 [0114.250] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.250] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml")) returned 1 [0114.250] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml")) returned 0xffffffff [0114.250] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1 [0114.251] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.251] CloseHandle (hObject=0xffffffff) returned 1 [0114.251] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml.z49-css-qhb")) returned 0 [0114.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 0x7e2888 [0114.251] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 0 [0114.252] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0114.252] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml")) returned 1 [0114.252] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml")) returned 0xffffffff [0114.252] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1 [0114.253] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.253] CloseHandle (hObject=0xffffffff) returned 1 [0114.253] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml.z49-css-qhb")) returned 0 [0114.253] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml.z49-css-qhb")) returned 0xffffffff [0114.253] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 0x7e26c8 [0114.254] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 0 [0114.254] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0114.254] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml")) returned 1 [0114.254] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml")) returned 0xffffffff [0114.255] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1 [0114.255] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.298] CloseHandle (hObject=0xffffffff) returned 1 [0114.298] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml.z49-css-qhb")) returned 0 [0114.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 0x7e2b48 [0114.299] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 0 [0114.299] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0114.299] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml")) returned 1 [0114.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml")) returned 0xffffffff [0114.300] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1 [0114.300] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.300] CloseHandle (hObject=0xffffffff) returned 1 [0114.300] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml.z49-css-qhb")) returned 0 [0114.301] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml.z49-css-qhb")) returned 0xffffffff [0114.301] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 0x7e2a48 [0114.301] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 0 [0114.301] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.301] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml")) returned 1 [0114.302] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml")) returned 0xffffffff [0114.302] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1 [0114.302] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.302] CloseHandle (hObject=0xffffffff) returned 1 [0114.302] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml.z49-css-qhb")) returned 0 [0114.302] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml.z49-css-qhb")) returned 0xffffffff [0114.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0x7e2888 [0114.303] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0 [0114.303] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0114.303] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml")) returned 1 [0114.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml")) returned 0xffffffff [0114.304] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0 [0114.304] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.304] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35623864, dwReserved1=0x31302d64, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1 [0114.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0114.304] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.304] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0114.305] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0114.305] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35623864, dwReserved1=0x31302d64, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1 [0114.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0114.305] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.305] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b11c43, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b37da3, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="P-ARIA", cAlternateFileName="")) returned 1 [0114.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="H,~")) returned 0xffffffff [0114.306] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b11c43, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b37da3, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="P-ARIA", cAlternateFileName="")) returned 0 [0114.306] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0114.307] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35414952, dwReserved1=0x31302d64, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1 [0114.307] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0114.308] CloseHandle (hObject=0xffffffff) returned 1 [0114.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat.z49-css-qhb")) returned 0 [0114.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat.z49-css-qhb")) returned 0xffffffff [0114.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0x7e2848 [0114.308] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0 [0114.309] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat")) returned 1 [0114.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat")) returned 0xffffffff [0114.309] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35414952, dwReserved1=0x31302d64, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0 [0114.310] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0114.310] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53786574, dwReserved1=0x6d656863, cFileName="DRM", cAlternateFileName="")) returned 1 [0114.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0114.310] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.310] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName="Server", cAlternateFileName="")) returned 1 [0114.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0114.311] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.311] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.311] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0114.311] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName="Server", cAlternateFileName="")) returned 0 [0114.311] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.311] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53726576, dwReserved1=0x6d656863, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0114.311] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0114.312] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName="Views", cAlternateFileName="")) returned 1 [0114.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0114.313] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0114.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0114.313] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0114.313] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0114.313] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0114.314] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0114.314] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0114.314] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b8, dwReserved1=0x40221d, cFileName="Views", cAlternateFileName="")) returned 0 [0114.314] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0114.314] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53727377, dwReserved1=0x6d656863, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0114.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6163696c, dwReserved1=0x6e6f6974, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0114.314] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6163696c, dwReserved1=0x6e6f6974, cFileName="..", cAlternateFileName="")) returned 1 [0114.314] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6163696c, dwReserved1=0x6e6f6974, cFileName="INT", cAlternateFileName="")) returned 1 [0114.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0114.315] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.315] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0114.315] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0114.315] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0114.315] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62e0 [0114.316] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0114.316] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0114.588] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x62e0, lpOverlapped=0x0) returned 1 [0114.592] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x62e0, lpOverlapped=0x0) returned 1 [0114.595] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0114.845] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.870] CloseHandle (hObject=0x1e8) returned 1 [0114.870] CloseHandle (hObject=0x1f8) returned 1 [0114.875] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.z49-css-qhb")) returned 0 [0114.877] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.z49-css-qhb")) returned 0x20 [0114.877] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0x7e2608 [0114.877] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0114.877] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0114.878] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll")) returned 1 [0114.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll")) returned 0xffffffff [0114.889] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0114.889] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0114.889] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c72, dwReserved1=0x6769666e, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0114.890] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0114.890] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0114.890] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0114.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0114.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0114.894] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60e0 [0114.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0114.895] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0115.220] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x60e0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x60e0, lpOverlapped=0x0) returned 1 [0115.222] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x60e0, lpOverlapped=0x0) returned 1 [0115.236] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.319] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.335] CloseHandle (hObject=0x1f8) returned 1 [0115.335] CloseHandle (hObject=0x1e8) returned 1 [0115.338] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.z49-css-qhb")) returned 0 [0115.338] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.z49-css-qhb")) returned 0x20 [0115.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x0, dwReserved1=0x5c, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0x7e2888 [0115.339] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x0, dwReserved1=0x5c, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0115.339] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0115.339] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll")) returned 1 [0115.341] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll")) returned 0xffffffff [0115.341] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="temp", cAlternateFileName="")) returned 1 [0115.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0115.341] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.341] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.342] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0115.342] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="temp", cAlternateFileName="")) returned 0 [0115.342] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0115.342] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c72, dwReserved1=0x6769666e, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0115.342] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0115.342] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74637564, dwReserved1=0x6d6e6f69, cFileName="MapData", cAlternateFileName="")) returned 1 [0115.342] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MapData\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c70, dwReserved1=0x6769666e, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0115.343] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c70, dwReserved1=0x6769666e, cFileName="..", cAlternateFileName="")) returned 1 [0115.343] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c70, dwReserved1=0x6769666e, cFileName="..", cAlternateFileName="")) returned 0 [0115.343] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0115.343] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74637564, dwReserved1=0x6d6e6f69, cFileName="MF", cAlternateFileName="")) returned 1 [0115.343] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c70, dwReserved1=0x6769666e, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0115.343] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f636c70, dwReserved1=0x6769666e, cFileName="..", cAlternateFileName="")) returned 1 [0115.343] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x6f636c70, dwReserved1=0x6769666e, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0115.343] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0115.343] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0115.344] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0115.344] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6964, dwReserved1=0x4c52472e, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0115.344] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0115.344] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0115.344] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0115.344] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0115.344] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0115.345] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0115.345] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0115.345] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0115.345] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0115.345] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72636461, dwReserved1=0x53626d75, cFileName="Network", cAlternateFileName="")) returned 1 [0115.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0115.346] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0115.346] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0115.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0115.347] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0115.347] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="Cm", cAlternateFileName="")) returned 1 [0115.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0115.387] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0115.388] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0115.388] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0115.388] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="CM_old", cAlternateFileName="")) returned 1 [0115.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0115.390] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0115.390] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0115.390] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0115.390] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="CM_old", cAlternateFileName="")) returned 0 [0115.391] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0115.391] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x646c6f, dwReserved1=0x40221d, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0115.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0115.391] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0115.391] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9be44b45, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1dc, dwReserved1=0x40221d, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0115.391] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0115.391] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0115.393] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0115.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0115.394] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0115.585] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0115.586] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0115.588] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.662] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.687] CloseHandle (hObject=0x1e8) returned 1 [0115.688] CloseHandle (hObject=0x1f8) returned 1 [0115.691] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk.z49-css-qhb")) returned 0 [0115.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk.z49-css-qhb")) returned 0x20 [0115.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9be44b45, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x4c, cFileName="edb.chk", cAlternateFileName="")) returned 0x7e2608 [0115.692] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9be44b45, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x4c, cFileName="edb.chk", cAlternateFileName="")) returned 0 [0115.692] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0115.692] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk")) returned 1 [0115.694] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk")) returned 0xffffffff [0115.695] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b7cc5b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x188, dwReserved1=0x40221d, cFileName="edb.log", cAlternateFileName="")) returned 1 [0115.695] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0115.695] CloseHandle (hObject=0xffffffff) returned 1 [0115.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log.z49-css-qhb")) returned 0 [0115.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log.z49-css-qhb")) returned 0xffffffff [0115.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b7cc5b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x4c, cFileName="edb.log", cAlternateFileName="")) returned 0x7e2c48 [0115.696] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b7cc5b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x4c, cFileName="edb.log", cAlternateFileName="")) returned 0 [0115.696] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0115.696] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log")) returned 0 [0115.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log")) returned 0x20 [0115.696] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e4d293, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x12c8, dwReserved1=0x40221d, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0115.696] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x1260, dwReserved1=0x40221d, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0115.697] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc63d09b3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x1260, dwReserved1=0x40221d, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0115.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0115.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0115.697] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140000 [0115.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0115.698] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0116.073] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x140000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x140000, lpOverlapped=0x0) returned 1 [0116.160] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x140000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x140000, lpOverlapped=0x0) returned 1 [0116.244] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.739] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.765] CloseHandle (hObject=0x1f8) returned 1 [0116.766] CloseHandle (hObject=0x1e8) returned 1 [0116.953] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log.z49-css-qhb")) returned 0 [0116.953] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log.z49-css-qhb")) returned 0x20 [0116.954] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc63d09b3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="edbtmp.log", cAlternateFileName="")) returned 0x7e2bc8 [0116.954] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc63d09b3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="edbtmp.log", cAlternateFileName="")) returned 0 [0116.954] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0116.954] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log")) returned 1 [0116.958] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log")) returned 0xffffffff [0116.992] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8873e787, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x8c, dwReserved1=0x40221d, cFileName="qmgr.db", cAlternateFileName="")) returned 1 [0116.992] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0116.993] CloseHandle (hObject=0xffffffff) returned 1 [0116.993] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db.z49-css-qhb")) returned 0 [0116.993] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db.z49-css-qhb")) returned 0xffffffff [0116.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8873e787, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x4c, cFileName="qmgr.db", cAlternateFileName="")) returned 0x7e2888 [0116.993] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8873e787, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x4c, cFileName="qmgr.db", cAlternateFileName="")) returned 0 [0116.993] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0116.994] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db")) returned 0 [0116.994] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db")) returned 0x220 [0116.994] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b5691b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="qmgr.jfm", cAlternateFileName="")) returned 1 [0116.994] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x18b5691b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="qmgr.jfm", cAlternateFileName="")) returned 0 [0116.994] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0116.994] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x646c6f, dwReserved1=0x40221d, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0116.994] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0116.994] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616f6c6e, dwReserved1=0x73726564, cFileName="Office", cAlternateFileName="")) returned 1 [0116.994] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x666a2e72, dwReserved1=0x32676f6d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0116.995] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x666a2e72, dwReserved1=0x32676f6d, cFileName="..", cAlternateFileName="")) returned 1 [0116.995] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x666a2e72, dwReserved1=0x32676f6d, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1 [0116.995] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0116.995] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0116.996] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0116.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0116.996] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0117.182] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x0, lpOverlapped=0x0) returned 1 [0117.182] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.215] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.295] CloseHandle (hObject=0x1ec) returned 1 [0117.295] CloseHandle (hObject=0x1e8) returned 1 [0117.296] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.296] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.296] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0x7e2888 [0117.297] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0 [0117.297] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0117.297] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 1 [0117.297] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.297] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.298] CloseHandle (hObject=0xffffffff) returned 1 [0117.298] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.298] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02l!\x07\x02(2@")) returned 0 [0117.298] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.298] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.299] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.299] CloseHandle (hObject=0xffffffff) returned 1 [0117.299] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.299] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.299] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.299] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02l!\x07\x02(2@")) returned 0 [0117.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.300] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.300] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.300] CloseHandle (hObject=0xffffffff) returned 1 [0117.300] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.300] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0117.301] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0117.301] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.301] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.301] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.301] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.301] CloseHandle (hObject=0xffffffff) returned 1 [0117.301] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.301] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.301] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0117.302] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0117.302] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.302] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.302] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.303] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.303] CloseHandle (hObject=0xffffffff) returned 1 [0117.303] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.303] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0117.303] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0117.303] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.303] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.304] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.304] CloseHandle (hObject=0xffffffff) returned 1 [0117.304] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0117.304] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0117.305] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.305] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.305] CloseHandle (hObject=0xffffffff) returned 1 [0117.305] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.306] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02l!\x07\x02(2@")) returned 0 [0117.306] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.306] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.306] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.306] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.306] CloseHandle (hObject=0xffffffff) returned 1 [0117.306] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.306] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.307] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02l!\x07\x02(2@")) returned 0 [0117.307] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.307] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.307] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.307] CloseHandle (hObject=0xffffffff) returned 1 [0117.307] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="4#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.308] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="4#\x07\x02l!\x07\x02(2@")) returned 0 [0117.308] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.308] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.308] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.308] CloseHandle (hObject=0xffffffff) returned 1 [0117.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.309] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D#\x07\x02l!\x07\x02(2@")) returned 0 [0117.309] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.309] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.309] CloseHandle (hObject=0xffffffff) returned 1 [0117.309] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.310] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T#\x07\x02l!\x07\x02(2@")) returned 0 [0117.310] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.310] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.310] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.310] CloseHandle (hObject=0xffffffff) returned 1 [0117.311] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.311] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.311] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="d#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.311] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="d#\x07\x02l!\x07\x02(2@")) returned 0 [0117.311] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.311] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.311] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.311] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.312] CloseHandle (hObject=0xffffffff) returned 1 [0117.312] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.312] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="t#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.312] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="t#\x07\x02l!\x07\x02(2@")) returned 0 [0117.312] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.312] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.312] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.313] CloseHandle (hObject=0xffffffff) returned 1 [0117.313] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.313] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02l!\x07\x02(2@")) returned 0 [0117.313] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.313] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.314] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.314] CloseHandle (hObject=0xffffffff) returned 1 [0117.314] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0 [0117.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker.z49-css-qhb")) returned 0x20 [0117.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94#\x07\x02l!\x07\x02(2@")) returned 0xffffffff [0117.314] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d4c38, ftLastAccessTime.dwHighDateTime=0x13, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94#\x07\x02l!\x07\x02(2@")) returned 0 [0117.314] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.314] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\" (normalized: "c:\\users\\all users\\microsoft\\office")) returned 0 [0117.315] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0xffffffff [0117.315] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x666a2e72, dwReserved1=0x32676f6d, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0 [0117.315] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0117.315] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f546b63, dwReserved1=0x506e7552, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0117.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0117.317] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0117.318] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="countrytable.xml", cAlternateFileName="")) returned 1 [0117.318] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0117.320] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0117.321] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70bb [0117.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0117.321] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0117.502] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x70bb, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x70bb, lpOverlapped=0x0) returned 1 [0117.515] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x70bb, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x70bb, lpOverlapped=0x0) returned 1 [0117.517] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.580] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.598] CloseHandle (hObject=0x1e8) returned 1 [0117.647] CloseHandle (hObject=0x1ec) returned 1 [0117.649] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml.z49-css-qhb")) returned 0 [0117.649] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml.z49-css-qhb")) returned 0x20 [0117.649] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="countrytable.xml", cAlternateFileName="")) returned 0x7e2848 [0117.650] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="countrytable.xml", cAlternateFileName="")) returned 0 [0117.650] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0117.650] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml")) returned 1 [0117.650] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml")) returned 0xffffffff [0117.650] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1 [0117.650] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0117.652] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.652] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ea7c91, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0117.652] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0117.652] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0117.656] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98c [0117.656] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0117.657] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0117.938] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x98c, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x98c, lpOverlapped=0x0) returned 1 [0117.941] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x98c, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x98c, lpOverlapped=0x0) returned 1 [0117.942] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.032] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.048] CloseHandle (hObject=0x1e8) returned 1 [0118.048] CloseHandle (hObject=0x1f8) returned 1 [0118.049] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.z49-css-qhb")) returned 0 [0118.050] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.z49-css-qhb")) returned 0x20 [0118.050] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ea7c91, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2508 [0118.050] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ea7c91, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0118.051] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0118.051] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml")) returned 1 [0118.052] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml")) returned 0xffffffff [0118.053] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x28c, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0118.053] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0118.054] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0118.054] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0118.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0118.055] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0118.325] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0118.326] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0118.327] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.413] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.429] CloseHandle (hObject=0x1f8) returned 1 [0118.429] CloseHandle (hObject=0x1e8) returned 1 [0118.430] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0118.431] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0118.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2908 [0118.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0118.431] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0118.431] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml")) returned 1 [0118.432] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml")) returned 0xffffffff [0118.432] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0118.433] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0118.433] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.433] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0118.433] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0118.433] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0118.433] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0118.433] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0118.433] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0118.433] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0118.433] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0118.434] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0118.434] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x243 [0118.434] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0118.434] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0118.607] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x243, lpOverlapped=0x0) returned 1 [0118.609] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x243, lpOverlapped=0x0) returned 1 [0118.611] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.964] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.042] CloseHandle (hObject=0x1f8) returned 1 [0119.042] CloseHandle (hObject=0x1f4) returned 1 [0119.047] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0119.048] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0119.048] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2688 [0119.048] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0119.048] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0119.048] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml")) returned 1 [0119.050] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml")) returned 0xffffffff [0119.050] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0119.050] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0119.050] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0119.050] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0119.050] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0119.050] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0119.052] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0119.052] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0119.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0119.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0119.056] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x504 [0119.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0119.056] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0119.332] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x504, lpOverlapped=0x0) returned 1 [0119.335] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x504, lpOverlapped=0x0) returned 1 [0119.337] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.429] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.454] CloseHandle (hObject=0x1e8) returned 1 [0119.454] CloseHandle (hObject=0x1f4) returned 1 [0119.506] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.z49-css-qhb")) returned 0 [0119.507] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.z49-css-qhb")) returned 0x20 [0119.507] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2a88 [0119.507] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0119.507] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0119.508] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml")) returned 1 [0119.509] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml")) returned 0xffffffff [0119.509] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0119.509] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0119.509] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0119.509] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0119.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0119.510] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0119.639] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0119.679] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0119.681] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.039] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.073] CloseHandle (hObject=0x1f4) returned 1 [0120.073] CloseHandle (hObject=0x1e8) returned 1 [0120.073] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0120.074] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0120.074] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2608 [0120.074] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0120.074] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0120.075] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml")) returned 1 [0120.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml")) returned 0xffffffff [0120.076] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0120.126] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0120.128] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.128] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0120.128] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0120.128] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0120.128] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6fcbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e6fcbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Controls.provxml", cAlternateFileName="")) returned 1 [0120.129] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="1__Power_Controls.provxml", cAlternateFileName="")) returned 1 [0120.129] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="1__Power_Controls.provxml", cAlternateFileName="")) returned 0 [0120.129] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0120.129] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x65776f50, dwReserved1=0x6f435f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0120.129] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0120.130] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0120.130] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ab [0120.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0120.131] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0120.370] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1ab, lpOverlapped=0x0) returned 1 [0120.405] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1ab, lpOverlapped=0x0) returned 1 [0120.407] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.449] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.520] CloseHandle (hObject=0x1f4) returned 1 [0120.521] CloseHandle (hObject=0x1f8) returned 1 [0120.523] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0120.523] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0120.524] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2608 [0120.524] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0120.524] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0120.524] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml")) returned 1 [0120.526] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml")) returned 0xffffffff [0120.526] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x65776f50, dwReserved1=0x6f435f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0120.526] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0120.526] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0120.527] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0120.527] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0120.527] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0120.527] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0120.527] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540f90a7, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcb9, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0120.527] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0120.529] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0120.533] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb9 [0120.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0120.534] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0120.727] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xcb9, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xcb9, lpOverlapped=0x0) returned 1 [0120.892] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xcb9, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xcb9, lpOverlapped=0x0) returned 1 [0120.893] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.982] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.002] CloseHandle (hObject=0x1e8) returned 1 [0121.002] CloseHandle (hObject=0x1f8) returned 1 [0121.003] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.z49-css-qhb")) returned 0 [0121.004] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.z49-css-qhb")) returned 0x20 [0121.004] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540f90a7, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcb9, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2a48 [0121.004] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540f90a7, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcb9, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0121.004] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0121.005] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml")) returned 1 [0121.007] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml")) returned 0xffffffff [0121.007] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0121.007] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0121.007] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0121.008] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0121.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0121.008] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0121.191] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0121.238] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0121.239] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.280] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.352] CloseHandle (hObject=0x1f8) returned 1 [0121.352] CloseHandle (hObject=0x1e8) returned 1 [0121.353] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0121.353] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0121.353] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2a88 [0121.354] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0121.354] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0121.354] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml")) returned 1 [0121.355] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml")) returned 0xffffffff [0121.356] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0121.356] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0121.356] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.356] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0121.356] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0121.356] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0121.356] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54060701, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcdd, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0121.357] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54060701, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcdd, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0121.357] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0121.357] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0121.357] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0121.357] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0121.357] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0121.357] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0121.358] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0121.540] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0121.542] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0121.543] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.623] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.640] CloseHandle (hObject=0x1f8) returned 1 [0121.640] CloseHandle (hObject=0x1f4) returned 1 [0121.642] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0121.642] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0121.643] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2848 [0121.643] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0121.643] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0121.643] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml")) returned 1 [0121.645] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml")) returned 0xffffffff [0121.646] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0121.646] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0121.646] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0121.646] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0121.646] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0121.646] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0121.691] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0121.691] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0121.692] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0121.692] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0121.753] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65f [0121.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0121.754] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0122.042] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x65f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x65f, lpOverlapped=0x0) returned 1 [0122.044] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x65f, lpOverlapped=0x0) returned 1 [0122.046] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.136] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.148] CloseHandle (hObject=0x1e8) returned 1 [0122.148] CloseHandle (hObject=0x1f4) returned 1 [0122.149] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.z49-css-qhb")) returned 0 [0122.150] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.z49-css-qhb")) returned 0x20 [0122.150] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2c08 [0122.150] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0122.151] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0122.151] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml")) returned 1 [0122.152] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml")) returned 0xffffffff [0122.152] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0122.152] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0122.153] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0122.153] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0122.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0122.154] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0122.349] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0122.350] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0122.351] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.421] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.434] CloseHandle (hObject=0x1f4) returned 1 [0122.434] CloseHandle (hObject=0x1e8) returned 1 [0122.435] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0122.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0122.435] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2548 [0122.435] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0122.436] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0122.436] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml")) returned 1 [0122.437] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml")) returned 0xffffffff [0122.437] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0122.437] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0122.438] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.438] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0122.438] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0122.438] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0122.438] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0122.438] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0122.438] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0122.439] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0122.439] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0122.439] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0122.440] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac [0122.440] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0122.440] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0122.716] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1ac, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1ac, lpOverlapped=0x0) returned 1 [0122.717] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1ac, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1ac, lpOverlapped=0x0) returned 1 [0122.718] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.744] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.835] CloseHandle (hObject=0x1f4) returned 1 [0122.835] CloseHandle (hObject=0x1f8) returned 1 [0122.836] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0122.837] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0122.837] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2848 [0122.837] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0122.837] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0122.837] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml")) returned 1 [0122.838] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml")) returned 0xffffffff [0122.839] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0122.839] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0122.839] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0122.839] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0122.839] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0122.839] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0122.840] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0122.840] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef7d10, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0122.840] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0122.840] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0122.842] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f [0122.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0122.843] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0123.046] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x59f, lpOverlapped=0x0) returned 1 [0123.049] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x59f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x59f, lpOverlapped=0x0) returned 1 [0123.050] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.168] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.184] CloseHandle (hObject=0x1e8) returned 1 [0123.184] CloseHandle (hObject=0x1f8) returned 1 [0123.187] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.z49-css-qhb")) returned 0 [0123.187] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.z49-css-qhb")) returned 0x20 [0123.187] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef7d10, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2848 [0123.188] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef7d10, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0123.188] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0123.188] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml")) returned 1 [0123.189] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml")) returned 0xffffffff [0123.189] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0123.189] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0123.189] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0123.190] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0123.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0123.190] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0123.455] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0123.504] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0123.505] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.583] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.598] CloseHandle (hObject=0x1f8) returned 1 [0123.598] CloseHandle (hObject=0x1e8) returned 1 [0123.599] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0123.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0123.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2608 [0123.600] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0123.600] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0123.600] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml")) returned 1 [0123.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml")) returned 0xffffffff [0123.601] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0123.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0123.602] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.602] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0123.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0123.603] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0123.603] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53eab83a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0123.603] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53eab83a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0123.603] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0123.603] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0123.603] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0123.604] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0123.604] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0123.604] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0123.604] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0123.910] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0123.911] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0123.913] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.021] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.035] CloseHandle (hObject=0x1f8) returned 1 [0124.036] CloseHandle (hObject=0x1f4) returned 1 [0124.036] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0124.037] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0124.037] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2b48 [0124.037] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0124.037] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0124.037] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml")) returned 1 [0124.038] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml")) returned 0xffffffff [0124.038] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0124.038] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0124.038] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0124.039] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0124.039] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0124.039] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0124.041] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0124.041] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54134c0b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1144, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0124.041] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0124.042] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0124.042] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1144 [0124.042] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0124.043] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0124.252] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1144, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1144, lpOverlapped=0x0) returned 1 [0124.454] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1144, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1144, lpOverlapped=0x0) returned 1 [0124.456] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.486] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.538] CloseHandle (hObject=0x1e8) returned 1 [0124.538] CloseHandle (hObject=0x1f4) returned 1 [0124.539] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.z49-css-qhb")) returned 0 [0124.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.z49-css-qhb")) returned 0x20 [0124.540] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54134c0b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1144, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0x7e2908 [0124.541] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54134c0b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1144, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0 [0124.541] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0124.541] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml")) returned 1 [0124.543] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml")) returned 0xffffffff [0124.543] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540c24cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0124.543] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0124.544] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0124.544] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0124.544] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0124.544] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0124.872] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0124.873] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0124.875] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.918] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.934] CloseHandle (hObject=0x1f4) returned 1 [0124.934] CloseHandle (hObject=0x1e8) returned 1 [0124.934] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0124.935] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0124.935] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540c24cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2bc8 [0124.935] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540c24cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0124.935] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0124.935] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml")) returned 1 [0124.936] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml")) returned 0xffffffff [0124.936] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0124.936] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0124.937] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.937] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0124.937] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0124.937] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0124.937] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54075ff8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54075ff8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1 [0124.937] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x905, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 1 [0124.937] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x905, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 0 [0124.937] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0124.937] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0124.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0124.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0124.938] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x257 [0124.938] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0124.938] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0125.050] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x257, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x257, lpOverlapped=0x0) returned 1 [0125.052] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x257, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x257, lpOverlapped=0x0) returned 1 [0125.054] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.185] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.202] CloseHandle (hObject=0x1f4) returned 1 [0125.203] CloseHandle (hObject=0x1f8) returned 1 [0125.204] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0125.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0125.204] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2888 [0125.205] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0125.205] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0125.205] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml")) returned 1 [0125.206] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml")) returned 0xffffffff [0125.206] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0125.206] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0125.206] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0125.206] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0125.206] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0125.206] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0125.206] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0125.207] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fff1c4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0125.207] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.207] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0125.231] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d8 [0125.231] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0125.232] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0125.452] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x13d8, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x13d8, lpOverlapped=0x0) returned 1 [0125.461] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x13d8, lpOverlapped=0x0) returned 1 [0125.462] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.491] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.507] CloseHandle (hObject=0x1e8) returned 1 [0125.507] CloseHandle (hObject=0x1f8) returned 1 [0125.511] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.z49-css-qhb")) returned 0 [0125.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.z49-css-qhb")) returned 0x20 [0125.512] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fff1c4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2848 [0125.512] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fff1c4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0125.512] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0125.512] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml")) returned 1 [0125.513] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml")) returned 0xffffffff [0125.513] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8cab3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0125.514] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0125.514] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.514] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0125.514] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0125.515] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0125.602] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0125.603] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0125.604] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.646] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.666] CloseHandle (hObject=0x1f8) returned 1 [0125.667] CloseHandle (hObject=0x1e8) returned 1 [0125.667] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0125.667] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0125.668] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8cab3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2bc8 [0125.668] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8cab3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0125.668] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0125.668] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml")) returned 1 [0125.669] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml")) returned 0xffffffff [0125.669] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0125.669] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0125.670] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.670] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0125.670] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0125.670] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0125.670] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f405fa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f405fa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0125.671] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x254, dwReserved1=0x40221d, cFileName="1__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0125.671] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x254, dwReserved1=0x40221d, cFileName="1__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0125.671] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0125.671] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0125.671] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0125.671] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0125.671] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23f [0125.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0125.672] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0125.765] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23f, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23f, lpOverlapped=0x0) returned 1 [0125.921] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23f, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23f, lpOverlapped=0x0) returned 1 [0125.923] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.969] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.034] CloseHandle (hObject=0x1f8) returned 1 [0126.034] CloseHandle (hObject=0x1f4) returned 1 [0126.035] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0126.036] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0126.036] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2888 [0126.036] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0126.037] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0126.037] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml")) returned 1 [0126.038] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml")) returned 0xffffffff [0126.038] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0126.038] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0126.039] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0126.039] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0126.039] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0126.039] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0126.042] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0126.042] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f19b66, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0126.042] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.043] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0126.045] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34d [0126.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0126.046] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0126.227] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x34d, lpOverlapped=0x0) returned 1 [0126.234] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x34d, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x34d, lpOverlapped=0x0) returned 1 [0126.236] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.316] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.363] CloseHandle (hObject=0x1e8) returned 1 [0126.363] CloseHandle (hObject=0x1f4) returned 1 [0126.365] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.z49-css-qhb")) returned 0 [0126.365] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.z49-css-qhb")) returned 0x20 [0126.366] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f19b66, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2908 [0126.366] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f19b66, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0126.366] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0126.366] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml")) returned 1 [0126.367] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml")) returned 0xffffffff [0126.368] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x40, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0126.368] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0126.369] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.369] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0126.369] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0126.370] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0126.529] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0126.531] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0126.533] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.605] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.632] CloseHandle (hObject=0x1f4) returned 1 [0126.632] CloseHandle (hObject=0x1e8) returned 1 [0126.632] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0126.633] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0126.633] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2848 [0126.634] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0126.634] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0126.634] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml")) returned 1 [0126.636] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml")) returned 0xffffffff [0126.636] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0126.637] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0126.637] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.637] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0126.637] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0126.637] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0126.637] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ecd6b4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0126.637] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ecd6b4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0126.638] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0126.638] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0126.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0126.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0126.638] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0126.638] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0126.639] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0126.933] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x102, lpOverlapped=0x0) returned 1 [0126.935] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x102, lpOverlapped=0x0) returned 1 [0126.937] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.014] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.035] CloseHandle (hObject=0x1f4) returned 1 [0127.036] CloseHandle (hObject=0x1f8) returned 1 [0127.039] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0127.040] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0127.040] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2c48 [0127.041] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0127.041] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0127.041] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml")) returned 1 [0127.043] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml")) returned 0xffffffff [0127.043] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0127.043] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0127.043] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0127.043] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0127.044] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0127.044] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0127.044] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0127.044] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fedfc8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0127.044] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.044] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0127.065] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x380 [0127.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0127.065] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0127.222] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x380, lpOverlapped=0x0) returned 1 [0127.224] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x380, lpOverlapped=0x0) returned 1 [0127.226] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.293] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.315] CloseHandle (hObject=0x1e8) returned 1 [0127.315] CloseHandle (hObject=0x1f8) returned 1 [0127.369] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.z49-css-qhb")) returned 0 [0127.370] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.z49-css-qhb")) returned 0x20 [0127.370] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fedfc8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2608 [0127.370] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fedfc8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0127.370] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0127.371] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml")) returned 1 [0127.372] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml")) returned 0xffffffff [0127.372] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0127.373] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0127.373] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.373] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0127.373] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0127.374] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0127.495] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0127.506] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0127.507] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.570] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.594] CloseHandle (hObject=0x1f8) returned 1 [0127.594] CloseHandle (hObject=0x1e8) returned 1 [0127.594] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0127.595] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0127.595] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e26c8 [0127.595] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0127.595] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0127.595] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml")) returned 1 [0127.596] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml")) returned 0xffffffff [0127.597] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0127.597] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0127.598] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.598] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0127.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0127.598] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0127.598] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0127.598] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0127.598] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0127.598] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0127.599] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0127.599] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0127.599] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0127.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0127.600] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0127.923] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x102, lpOverlapped=0x0) returned 1 [0127.926] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x102, lpOverlapped=0x0) returned 1 [0127.927] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.986] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.014] CloseHandle (hObject=0x1f8) returned 1 [0128.014] CloseHandle (hObject=0x1f4) returned 1 [0128.015] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0128.016] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0128.016] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2608 [0128.016] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0128.016] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0128.016] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml")) returned 1 [0128.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml")) returned 0xffffffff [0128.018] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0128.018] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0128.019] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0128.019] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0128.019] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0128.019] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0128.020] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0128.020] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8c7, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0128.021] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.021] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0128.026] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c7 [0128.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0128.026] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0128.249] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8c7, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x8c7, lpOverlapped=0x0) returned 1 [0128.252] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8c7, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x8c7, lpOverlapped=0x0) returned 1 [0128.254] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.336] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.372] CloseHandle (hObject=0x1e8) returned 1 [0128.373] CloseHandle (hObject=0x1f4) returned 1 [0128.374] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.z49-css-qhb")) returned 0 [0128.375] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.z49-css-qhb")) returned 0x20 [0128.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8c7, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2608 [0128.375] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8c7, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0128.375] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0128.375] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml")) returned 1 [0128.377] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml")) returned 0xffffffff [0128.378] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x16c, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0128.378] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0128.379] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.379] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0128.379] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0128.380] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0128.541] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0128.543] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0128.544] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.596] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.625] CloseHandle (hObject=0x1f4) returned 1 [0128.626] CloseHandle (hObject=0x1e8) returned 1 [0128.626] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0128.627] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0128.627] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2b88 [0128.627] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0128.627] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0128.628] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml")) returned 1 [0128.629] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml")) returned 0xffffffff [0128.630] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0128.630] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0128.630] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.630] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0128.630] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0128.630] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0128.630] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0128.630] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0128.631] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0128.631] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0128.631] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0128.631] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0128.631] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cc [0128.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0128.632] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0128.823] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0128.825] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0128.827] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.007] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.036] CloseHandle (hObject=0x1f4) returned 1 [0129.037] CloseHandle (hObject=0x1f8) returned 1 [0129.038] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0129.040] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0129.041] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2a48 [0129.041] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0129.041] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0129.041] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml")) returned 1 [0129.043] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml")) returned 0xffffffff [0129.043] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0129.044] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0129.044] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0129.044] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0129.044] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0129.044] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0129.045] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0129.045] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5410decf, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc1, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0129.046] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0129.046] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0129.049] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cc1 [0129.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0129.050] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0129.207] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1cc1, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1cc1, lpOverlapped=0x0) returned 1 [0129.209] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1cc1, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1cc1, lpOverlapped=0x0) returned 1 [0129.211] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.291] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.315] CloseHandle (hObject=0x1e8) returned 1 [0129.316] CloseHandle (hObject=0x1f8) returned 1 [0129.317] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.z49-css-qhb")) returned 0 [0129.318] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.z49-css-qhb")) returned 0x20 [0129.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5410decf, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc1, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2648 [0129.318] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5410decf, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc1, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0129.318] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0129.318] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml")) returned 1 [0129.327] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml")) returned 0xffffffff [0129.327] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0129.327] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0129.334] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0129.334] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0129.334] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0129.335] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0129.626] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0129.629] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0129.631] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.771] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.796] CloseHandle (hObject=0x1f8) returned 1 [0129.796] CloseHandle (hObject=0x1e8) returned 1 [0129.797] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0129.798] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0129.798] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2b48 [0129.798] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0129.798] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0129.798] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml")) returned 1 [0129.800] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml")) returned 0xffffffff [0129.800] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0129.800] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0129.801] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.801] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0129.801] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0129.825] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0129.825] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fdcb85, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1bae, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0129.825] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fdcb85, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1bae, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0129.825] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0129.826] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0129.826] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0129.826] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0129.827] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cc [0129.827] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0129.827] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0130.072] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0130.074] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0130.076] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.141] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.196] CloseHandle (hObject=0x1f8) returned 1 [0130.196] CloseHandle (hObject=0x1f4) returned 1 [0130.197] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0130.198] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0130.198] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2a88 [0130.198] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0130.198] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0130.198] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml")) returned 1 [0130.200] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml")) returned 0xffffffff [0130.200] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0130.200] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0130.201] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0130.201] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0130.201] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0130.201] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0130.207] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0130.207] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f9117b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0130.207] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0130.208] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0130.208] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85a [0130.208] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0130.209] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0130.371] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x85a, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x85a, lpOverlapped=0x0) returned 1 [0130.374] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x85a, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x85a, lpOverlapped=0x0) returned 1 [0130.375] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.476] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.499] CloseHandle (hObject=0x1e8) returned 1 [0130.506] CloseHandle (hObject=0x1f4) returned 1 [0130.516] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.z49-css-qhb")) returned 0 [0130.565] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.z49-css-qhb")) returned 0x20 [0130.566] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f9117b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0x7e2a48 [0130.566] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f9117b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0 [0130.566] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0130.566] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml")) returned 1 [0130.568] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml")) returned 0xffffffff [0130.568] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6af14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0130.568] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0130.569] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0130.570] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0130.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0130.570] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0130.760] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0130.762] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0130.764] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.847] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.012] CloseHandle (hObject=0x1f4) returned 1 [0131.013] CloseHandle (hObject=0x1e8) returned 1 [0131.013] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0131.014] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0131.014] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6af14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2a48 [0131.014] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6af14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0131.015] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0131.015] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml")) returned 1 [0131.016] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml")) returned 0xffffffff [0131.016] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0131.016] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0131.018] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.018] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0131.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0131.018] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0131.018] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1 [0131.018] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 0 [0131.019] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0131.019] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0131.019] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0131.019] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0131.020] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0131.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0131.020] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0131.279] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0131.281] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0131.283] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.387] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.451] CloseHandle (hObject=0x1f4) returned 1 [0131.451] CloseHandle (hObject=0x1f8) returned 1 [0131.452] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0131.453] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0131.453] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2908 [0131.453] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0131.453] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0131.454] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml")) returned 1 [0131.456] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml")) returned 0xffffffff [0131.456] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x65776f50, dwReserved1=0x6f505f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0131.456] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0131.456] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0131.456] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0131.457] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0131.457] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0131.459] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0131.459] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fb24d6, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8b5, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0131.459] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.460] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0131.464] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b5 [0131.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0131.464] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0131.867] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8b5, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x8b5, lpOverlapped=0x0) returned 1 [0131.870] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8b5, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x8b5, lpOverlapped=0x0) returned 1 [0131.873] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.046] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.074] CloseHandle (hObject=0x1e8) returned 1 [0132.074] CloseHandle (hObject=0x1f8) returned 1 [0132.079] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.z49-css-qhb")) returned 0 [0132.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.z49-css-qhb")) returned 0x20 [0132.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fb24d6, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8b5, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2c48 [0132.080] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fb24d6, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8b5, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0132.080] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0132.080] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml")) returned 1 [0132.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml")) returned 0xffffffff [0132.082] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8c279, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0132.082] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0132.083] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.083] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0132.083] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0132.083] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0132.275] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0132.278] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0132.280] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.367] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.389] CloseHandle (hObject=0x1f8) returned 1 [0132.389] CloseHandle (hObject=0x1e8) returned 1 [0132.390] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0132.390] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0132.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8c279, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e26c8 [0132.391] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8c279, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0132.391] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0132.391] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml")) returned 1 [0132.393] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml")) returned 0xffffffff [0132.394] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0132.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0132.407] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.407] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0132.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0132.408] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0132.408] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0132.408] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0132.408] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0132.408] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0132.409] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0132.409] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0132.409] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cc [0132.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0132.410] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0132.597] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0132.599] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0132.603] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.672] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.704] CloseHandle (hObject=0x1f8) returned 1 [0132.704] CloseHandle (hObject=0x1f4) returned 1 [0132.705] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0132.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0132.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2608 [0132.706] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0132.706] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0132.707] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml")) returned 1 [0132.709] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml")) returned 0xffffffff [0132.709] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0132.709] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0132.709] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0132.709] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0132.710] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0132.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0132.723] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0132.723] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0132.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0132.729] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67b [0132.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0132.729] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0133.142] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x67b, lpOverlapped=0x0) returned 1 [0133.145] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x67b, lpOverlapped=0x0) returned 1 [0133.148] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.316] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.351] CloseHandle (hObject=0x1e8) returned 1 [0133.351] CloseHandle (hObject=0x1f4) returned 1 [0133.353] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.z49-css-qhb")) returned 0 [0133.354] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.z49-css-qhb")) returned 0x20 [0133.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2848 [0133.354] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0 [0133.355] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0133.355] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml")) returned 1 [0133.357] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml")) returned 0xffffffff [0133.357] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x38, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0133.357] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0133.359] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.359] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0133.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0133.360] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0133.590] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0133.592] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0133.593] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.647] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.674] CloseHandle (hObject=0x1f4) returned 1 [0133.674] CloseHandle (hObject=0x1e8) returned 1 [0133.675] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0133.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0133.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2a48 [0133.676] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0 [0133.676] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0133.676] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml")) returned 1 [0133.678] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml")) returned 0xffffffff [0133.678] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0133.678] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0133.678] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.679] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0133.679] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0133.679] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0133.679] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f7b887, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0133.679] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f7b887, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0133.679] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0133.679] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0133.680] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0133.680] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0133.681] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x222 [0133.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0133.681] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0133.849] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x222, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x222, lpOverlapped=0x0) returned 1 [0133.862] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x222, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x222, lpOverlapped=0x0) returned 1 [0133.865] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.027] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.068] CloseHandle (hObject=0x1f4) returned 1 [0134.068] CloseHandle (hObject=0x1f8) returned 1 [0134.071] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0134.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0134.072] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2a88 [0134.072] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0134.072] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0134.073] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml")) returned 1 [0134.074] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml")) returned 0xffffffff [0134.075] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x65776f50, dwReserved1=0x6e455f72, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0134.075] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0134.075] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 0 [0134.075] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0134.075] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44726576, dwReserved1=0x73617461, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0134.075] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0134.079] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="..", cAlternateFileName="")) returned 1 [0134.080] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x656d6954, dwReserved1=0x6c6d782e, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0134.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0134.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0134.080] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ba5b [0134.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0134.081] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0134.280] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x9ba5b, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x9ba5b, lpOverlapped=0x0) returned 1 [0134.326] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x9ba5b, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x9ba5b, lpOverlapped=0x0) returned 1 [0134.350] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.395] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.428] CloseHandle (hObject=0x1e8) returned 1 [0134.428] CloseHandle (hObject=0x1f8) returned 1 [0134.451] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.z49-css-qhb")) returned 0 [0134.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.z49-css-qhb")) returned 0x20 [0134.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0x7e26c8 [0134.453] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0 [0134.453] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0134.453] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml")) returned 1 [0134.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml")) returned 0xffffffff [0134.465] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0134.466] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0134.466] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0134.468] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0134.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0134.469] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0134.611] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0134.613] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0134.615] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.657] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.673] CloseHandle (hObject=0x1f8) returned 1 [0134.673] CloseHandle (hObject=0x1e8) returned 1 [0134.673] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0134.674] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0134.674] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2608 [0134.675] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0134.675] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0134.675] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml")) returned 1 [0134.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml")) returned 0xffffffff [0134.676] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="Prov", cAlternateFileName="")) returned 1 [0134.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0134.676] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.676] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0134.677] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0134.717] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="..", cAlternateFileName="")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x5000005, cFileName="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="0__CON~1.PRO")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="100__C~1.PRO")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="101__C~1.PRO")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="102__C~1.PRO")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", cAlternateFileName="103__C~1.PRO")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="104__C~1.PRO")) returned 1 [0134.721] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="105__C~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="106__C~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="107__C~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="108__C~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="109__C~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="10__CO~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="110__C~1.PRO")) returned 1 [0134.722] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="111__C~1.PRO")) returned 1 [0134.723] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="112__C~1.PRO")) returned 1 [0134.723] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="113__C~1.PRO")) returned 1 [0134.723] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="114__C~1.PRO")) returned 1 [0134.723] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="115__C~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="116__C~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="117__C~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="118__C~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="119__C~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="11__CO~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="120__C~1.PRO")) returned 1 [0134.727] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="121__C~1.PRO")) returned 1 [0134.728] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="122__C~1.PRO")) returned 1 [0134.728] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", cAlternateFileName="123__C~1.PRO")) returned 1 [0134.728] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="124__C~1.PRO")) returned 1 [0134.728] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="125__C~1.PRO")) returned 1 [0134.728] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="126__C~1.PRO")) returned 1 [0134.728] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="127__C~1.PRO")) returned 1 [0134.729] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="128__C~1.PRO")) returned 1 [0134.729] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="129__C~1.PRO")) returned 1 [0134.729] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", cAlternateFileName="12__CO~1.PRO")) returned 1 [0134.729] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="130__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="131__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="132__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="133__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="134__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="135__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="136__C~1.PRO")) returned 1 [0134.732] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="137__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="138__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="139__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", cAlternateFileName="13__CO~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="140__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="141__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="142__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", cAlternateFileName="143__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", cAlternateFileName="144__C~1.PRO")) returned 1 [0134.733] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", cAlternateFileName="145__C~1.PRO")) returned 1 [0134.734] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="146__C~1.PRO")) returned 1 [0134.736] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="147__C~1.PRO")) returned 1 [0134.736] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="148__C~1.PRO")) returned 1 [0134.736] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="149__C~1.PRO")) returned 1 [0134.736] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", cAlternateFileName="14__CO~1.PRO")) returned 1 [0134.736] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="150__C~1.PRO")) returned 1 [0134.736] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="151__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="152__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", cAlternateFileName="153__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="154__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="155__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="156__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="157__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="158__C~1.PRO")) returned 1 [0134.737] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="159__C~1.PRO")) returned 1 [0134.738] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", cAlternateFileName="15__CO~1.PRO")) returned 1 [0134.738] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="160__C~1.PRO")) returned 1 [0134.738] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="161__C~1.PRO")) returned 1 [0134.741] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="162__C~1.PRO")) returned 1 [0134.742] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="163__C~1.PRO")) returned 1 [0134.742] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="164__C~1.PRO")) returned 1 [0134.742] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="165__C~1.PRO")) returned 1 [0134.742] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="166__C~1.PRO")) returned 1 [0134.742] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="167__C~1.PRO")) returned 1 [0134.742] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="168__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="169__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", cAlternateFileName="16__CO~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="170__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="171__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="172__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="173__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="174__C~1.PRO")) returned 1 [0134.743] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="175__C~1.PRO")) returned 1 [0134.744] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", cAlternateFileName="176__C~1.PRO")) returned 1 [0134.744] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", cAlternateFileName="177__C~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", cAlternateFileName="178__C~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", cAlternateFileName="179__C~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", cAlternateFileName="17__CO~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", cAlternateFileName="180__C~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="181__C~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="182__C~1.PRO")) returned 1 [0134.747] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="183__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="184__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="185__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="186__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="187__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", cAlternateFileName="188__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="189__C~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="18__CE~1.PRO")) returned 1 [0134.748] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="190__C~1.PRO")) returned 1 [0134.749] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="191__C~1.PRO")) returned 1 [0134.749] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="192__C~1.PRO")) returned 1 [0134.751] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="193__C~1.PRO")) returned 1 [0134.751] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="194__C~1.PRO")) returned 1 [0134.751] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="195__C~1.PRO")) returned 1 [0134.751] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="196__C~1.PRO")) returned 1 [0134.751] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="197__C~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="198__C~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="199__C~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="19__CE~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="1__CON~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="200__C~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x308, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="201__C~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="202__C~1.PRO")) returned 1 [0134.752] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="203__C~1.PRO")) returned 1 [0134.753] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="204__C~1.PRO")) returned 1 [0134.753] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="205__C~1.PRO")) returned 1 [0134.753] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="206__C~1.PRO")) returned 1 [0134.753] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="207__C~1.PRO")) returned 1 [0134.753] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="208__C~1.PRO")) returned 1 [0134.757] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="209__C~1.PRO")) returned 1 [0134.757] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="20__CO~1.PRO")) returned 1 [0134.757] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="210__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="211__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="212__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="213__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="214__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="215__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="216__C~1.PRO")) returned 1 [0134.758] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="217__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="218__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", cAlternateFileName="219__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="21__CO~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="220__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x312, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="221__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="222__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="223__C~1.PRO")) returned 1 [0134.759] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="224__C~1.PRO")) returned 1 [0134.765] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", cAlternateFileName="225__C~1.PRO")) returned 1 [0134.765] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="226__C~1.PRO")) returned 1 [0134.765] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="227__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="228__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="229__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="22__CO~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="230__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="231__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="232__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="233__C~1.PRO")) returned 1 [0134.766] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="234__C~1.PRO")) returned 1 [0134.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="235__C~1.PRO")) returned 1 [0134.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="236__C~1.PRO")) returned 1 [0134.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="237__C~1.PRO")) returned 1 [0134.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="238__C~1.PRO")) returned 1 [0134.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="239__C~1.PRO")) returned 1 [0134.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="23__CO~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", cAlternateFileName="240__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="241__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="242__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="243__Connections_Cellular_Bite Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="243__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="244__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="245__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="246__C~1.PRO")) returned 1 [0134.772] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="247__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="248__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="249__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="24__CE~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="250__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="251__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="252__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", cAlternateFileName="253__C~1.PRO")) returned 1 [0134.773] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="254__C~1.PRO")) returned 1 [0134.778] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="255__C~1.PRO")) returned 1 [0134.780] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="256__C~1.PRO")) returned 1 [0134.780] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="257__C~1.PRO")) returned 1 [0134.780] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="258__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="259__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="25__CE~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="260__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="261__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="262__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="263__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="264__C~1.PRO")) returned 1 [0134.781] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", cAlternateFileName="265__C~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="266__C~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="267__C~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="268__C~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="269__C~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="26__CO~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="270__C~1.PRO")) returned 1 [0134.782] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="271__C~1.PRO")) returned 1 [0134.787] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="272__C~1.PRO")) returned 1 [0134.787] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="273__C~1.PRO")) returned 1 [0134.787] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", cAlternateFileName="274__C~1.PRO")) returned 1 [0134.787] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", cAlternateFileName="275__C~1.PRO")) returned 1 [0134.787] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="276__C~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="277__C~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", cAlternateFileName="278__C~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", cAlternateFileName="279__C~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="27__CO~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", cAlternateFileName="280__C~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", cAlternateFileName="281__C~1.PRO")) returned 1 [0134.788] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", cAlternateFileName="282__C~1.PRO")) returned 1 [0134.789] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", cAlternateFileName="283__C~1.PRO")) returned 1 [0134.789] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="284__C~1.PRO")) returned 1 [0134.789] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", cAlternateFileName="285__C~1.PRO")) returned 1 [0134.789] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", cAlternateFileName="286__C~1.PRO")) returned 1 [0134.789] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", cAlternateFileName="287__C~1.PRO")) returned 1 [0134.793] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", cAlternateFileName="288__C~1.PRO")) returned 1 [0134.793] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", cAlternateFileName="289__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="28__CO~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", cAlternateFileName="290__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", cAlternateFileName="291__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="292__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="293__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="294__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="295__C~1.PRO")) returned 1 [0134.794] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="296__C~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="297__C~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="298__C~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="299__C~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="29__CO~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="2__CON~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="300__C~1.PRO")) returned 1 [0134.795] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="301__C~1.PRO")) returned 1 [0134.800] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", cAlternateFileName="302__C~1.PRO")) returned 1 [0134.800] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="303__C~1.PRO")) returned 1 [0134.800] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="304__C~1.PRO")) returned 1 [0134.800] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="305__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", cAlternateFileName="306__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="307__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="308__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="309__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="30__CO~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="310__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="311__C~1.PRO")) returned 1 [0134.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="312__C~1.PRO")) returned 1 [0134.802] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", cAlternateFileName="313__C~1.PRO")) returned 1 [0134.802] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="314__C~1.PRO")) returned 1 [0134.802] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="315__C~1.PRO")) returned 1 [0134.802] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="316__C~1.PRO")) returned 1 [0134.802] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="317__C~1.PRO")) returned 1 [0135.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0135.076] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0135.354] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4bf13, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x4bf13, lpOverlapped=0x0) returned 1 [0135.368] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4bf13, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x4bf13, lpOverlapped=0x0) returned 1 [0135.384] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.467] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.495] CloseHandle (hObject=0x1f8) returned 1 [0135.496] CloseHandle (hObject=0x1f4) returned 1 [0135.519] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0135.521] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0135.521] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2548 [0135.535] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0135.536] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0135.814] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x732, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x732, lpOverlapped=0x0) returned 1 [0135.818] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x732, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x732, lpOverlapped=0x0) returned 1 [0135.821] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.892] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.030] CloseHandle (hObject=0x1e8) returned 1 [0136.030] CloseHandle (hObject=0x1f4) returned 1 [0136.034] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.z49-css-qhb")) returned 0 [0136.035] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.z49-css-qhb")) returned 0x20 [0136.035] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2648 [0136.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0136.050] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0136.353] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0136.355] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0136.357] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.534] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.580] CloseHandle (hObject=0x1f4) returned 1 [0136.581] CloseHandle (hObject=0x1e8) returned 1 [0136.581] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0136.582] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0136.582] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2a48 [0136.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0136.586] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0137.013] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0137.016] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x1cc, lpOverlapped=0x0) returned 1 [0137.018] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.094] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.152] CloseHandle (hObject=0x1f4) returned 1 [0137.153] CloseHandle (hObject=0x1f8) returned 1 [0137.153] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0137.154] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0137.154] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2688 [0137.161] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0137.162] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0137.359] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8a8, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x8a8, lpOverlapped=0x0) returned 1 [0137.388] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x8a8, lpOverlapped=0x0) returned 1 [0137.390] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.452] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.487] CloseHandle (hObject=0x1e8) returned 1 [0137.487] CloseHandle (hObject=0x1f8) returned 1 [0137.488] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.z49-css-qhb")) returned 0 [0137.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.z49-css-qhb")) returned 0x20 [0137.489] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6a449, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6a449, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6a449, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8a8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="")) returned 0x7e2708 [0137.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0137.492] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0137.630] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0137.632] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0137.633] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.743] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.761] CloseHandle (hObject=0x1f8) returned 1 [0137.762] CloseHandle (hObject=0x1e8) returned 1 [0137.762] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0137.763] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0137.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 0x7e2848 [0137.778] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0137.779] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0138.011] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0138.013] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xfb, lpOverlapped=0x0) returned 1 [0138.015] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.075] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.106] CloseHandle (hObject=0x1f8) returned 1 [0138.106] CloseHandle (hObject=0x1f4) returned 1 [0138.107] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0138.107] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0138.107] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2bc8 [0138.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0138.115] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0138.268] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6274, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x6274, lpOverlapped=0x0) returned 1 [0138.280] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6274, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x6274, lpOverlapped=0x0) returned 1 [0138.283] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.364] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.390] CloseHandle (hObject=0x1e8) returned 1 [0138.391] CloseHandle (hObject=0x1f4) returned 1 [0138.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.z49-css-qhb")) returned 0 [0138.394] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.z49-css-qhb")) returned 0x20 [0138.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560ed25a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x560ed25a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x560ed25a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x6274, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 0x7e2b48 [0138.412] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0138.413] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0138.659] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0138.677] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10f, lpOverlapped=0x0) returned 1 [0138.678] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.718] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.740] CloseHandle (hObject=0x1f4) returned 1 [0138.740] CloseHandle (hObject=0x1e8) returned 1 [0138.740] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.z49-css-qhb")) returned 0 [0138.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.z49-css-qhb")) returned 0x20 [0138.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d0d528, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55d0d528, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55d0d528, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 0x7e2888 [0138.748] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0138.748] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0139.120] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x948, lpOverlapped=0x0) returned 1 [0139.128] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x948, lpOverlapped=0x0) returned 1 [0139.130] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.204] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.234] CloseHandle (hObject=0x1f4) returned 1 [0139.234] CloseHandle (hObject=0x1f8) returned 1 [0139.246] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.z49-css-qhb")) returned 0 [0139.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.z49-css-qhb")) returned 0x20 [0139.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="RunTime.xml", cAlternateFileName="")) returned 0x7e2bc8 [0139.294] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk.z49-css-qhb")) returned 0 [0139.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk.z49-css-qhb")) returned 0xffffffff [0139.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="edb.chk", cAlternateFileName="")) returned 0x7e2848 [0139.295] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log.z49-css-qhb")) returned 0 [0139.295] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log.z49-css-qhb")) returned 0xffffffff [0139.295] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dec862e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="edb.log", cAlternateFileName="")) returned 0x7e2848 [0139.302] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log.z49-css-qhb")) returned 0 [0139.302] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log.z49-css-qhb")) returned 0xffffffff [0139.302] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b42ee8a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="edb00002.log", cAlternateFileName="")) returned 0x7e2b08 [0139.303] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log.z49-css-qhb")) returned 0 [0139.303] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log.z49-css-qhb")) returned 0xffffffff [0139.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd24c5a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1deee89a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="edbtmp.log", cAlternateFileName="")) returned 0x7e26c8 [0139.304] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db.z49-css-qhb")) returned 0 [0139.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db.z49-css-qhb")) returned 0xffffffff [0139.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd973cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd973cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SmsInterceptStore.db", cAlternateFileName="SMSINT~1.DB")) returned 0x7e2c88 [0139.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0139.329] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0139.512] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x19a8, lpOverlapped=0x0) returned 1 [0139.520] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x19a8, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x19a8, lpOverlapped=0x0) returned 1 [0139.522] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.588] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.622] CloseHandle (hObject=0x1ec) returned 1 [0139.623] CloseHandle (hObject=0x1e8) returned 1 [0139.624] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat.z49-css-qhb")) returned 0 [0139.625] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat.z49-css-qhb")) returned 0x20 [0139.625] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x165f3a8f, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x5c, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 0x7e2a48 [0139.629] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0139.630] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0139.776] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1375f, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1375f, lpOverlapped=0x0) returned 1 [0139.797] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1375f, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1375f, lpOverlapped=0x0) returned 1 [0139.878] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.196] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.238] CloseHandle (hObject=0x1e8) returned 1 [0140.238] CloseHandle (hObject=0x1ec) returned 1 [0140.242] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat.z49-css-qhb")) returned 0 [0140.243] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat.z49-css-qhb")) returned 0x20 [0140.243] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0x7e2c08 [0140.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0140.253] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0140.467] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4771, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4771, lpOverlapped=0x0) returned 1 [0140.473] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4771, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4771, lpOverlapped=0x0) returned 1 [0140.476] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.536] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.583] CloseHandle (hObject=0x1e8) returned 1 [0140.583] CloseHandle (hObject=0x1f8) returned 1 [0140.586] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml.z49-css-qhb")) returned 0 [0140.586] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml.z49-css-qhb")) returned 0x20 [0140.586] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x5c, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 0x7e2888 [0140.588] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0140.589] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0140.807] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x173d, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x173d, lpOverlapped=0x0) returned 1 [0140.811] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x173d, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x173d, lpOverlapped=0x0) returned 1 [0140.813] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.890] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.006] CloseHandle (hObject=0x1f8) returned 1 [0141.006] CloseHandle (hObject=0x1e8) returned 1 [0141.009] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml.z49-css-qhb")) returned 0 [0141.009] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml.z49-css-qhb")) returned 0x20 [0141.009] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 0x7e2708 [0141.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0141.013] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0141.181] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc27, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xc27, lpOverlapped=0x0) returned 1 [0141.184] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc27, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xc27, lpOverlapped=0x0) returned 1 [0141.186] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.298] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.346] CloseHandle (hObject=0x1e8) returned 1 [0141.346] CloseHandle (hObject=0x1f8) returned 1 [0141.347] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml.z49-css-qhb")) returned 0 [0141.348] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml.z49-css-qhb")) returned 0x20 [0141.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 0x7e2688 [0141.349] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0141.349] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0141.517] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x9eb, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x9eb, lpOverlapped=0x0) returned 1 [0141.523] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x9eb, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x9eb, lpOverlapped=0x0) returned 1 [0141.525] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.595] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.627] CloseHandle (hObject=0x1f8) returned 1 [0141.627] CloseHandle (hObject=0x1e8) returned 1 [0141.632] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml.z49-css-qhb")) returned 0 [0141.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml.z49-css-qhb")) returned 0x20 [0141.632] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 0x7e2708 [0141.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0141.634] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0141.798] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xf80, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xf80, lpOverlapped=0x0) returned 1 [0141.814] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xf80, lpOverlapped=0x0) returned 1 [0141.817] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.875] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.021] CloseHandle (hObject=0x1e8) returned 1 [0142.022] CloseHandle (hObject=0x1f8) returned 1 [0142.027] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml.z49-css-qhb")) returned 0 [0142.028] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml.z49-css-qhb")) returned 0x20 [0142.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x5c, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 0x7e2ac8 [0142.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0142.032] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0142.275] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb31, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xb31, lpOverlapped=0x0) returned 1 [0142.307] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb31, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xb31, lpOverlapped=0x0) returned 1 [0142.309] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.393] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.553] CloseHandle (hObject=0x1f8) returned 1 [0142.554] CloseHandle (hObject=0x1e8) returned 1 [0142.559] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml.z49-css-qhb")) returned 0 [0142.561] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml.z49-css-qhb")) returned 0x20 [0142.562] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 0x7e2ac8 [0142.569] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0142.570] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0142.798] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb31, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xb31, lpOverlapped=0x0) returned 1 [0142.803] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb31, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xb31, lpOverlapped=0x0) returned 1 [0142.806] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.891] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.061] CloseHandle (hObject=0x1e8) returned 1 [0143.062] CloseHandle (hObject=0x1f8) returned 1 [0143.063] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml.z49-css-qhb")) returned 0 [0143.063] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml.z49-css-qhb")) returned 0x20 [0143.063] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 0x7e2a48 [0143.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0143.065] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0143.284] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3bd, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3bd, lpOverlapped=0x0) returned 1 [0143.337] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3bd, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3bd, lpOverlapped=0x0) returned 1 [0143.339] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.470] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.511] CloseHandle (hObject=0x1f8) returned 1 [0143.512] CloseHandle (hObject=0x1e8) returned 1 [0143.513] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml.z49-css-qhb")) returned 0 [0143.513] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml.z49-css-qhb")) returned 0x20 [0143.514] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x5c, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 0x7e2708 [0143.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0143.515] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0143.712] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x11c51, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x11c51, lpOverlapped=0x0) returned 1 [0143.719] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x11c51, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x11c51, lpOverlapped=0x0) returned 1 [0143.724] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.803] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.830] CloseHandle (hObject=0x1e8) returned 1 [0143.830] CloseHandle (hObject=0x1f8) returned 1 [0143.839] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml.z49-css-qhb")) returned 0 [0143.839] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml.z49-css-qhb")) returned 0x20 [0143.840] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 0x7e2a48 [0143.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0143.855] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0144.142] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x11c51, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x11c51, lpOverlapped=0x0) returned 1 [0144.149] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x11c51, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x11c51, lpOverlapped=0x0) returned 1 [0144.154] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.219] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.252] CloseHandle (hObject=0x1f8) returned 1 [0144.252] CloseHandle (hObject=0x1e8) returned 1 [0144.257] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml.z49-css-qhb")) returned 0 [0144.258] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml.z49-css-qhb")) returned 0x20 [0144.258] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 0x7e2688 [0144.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0144.263] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0144.479] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0144.483] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3368, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0144.486] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.560] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.593] CloseHandle (hObject=0x1e8) returned 1 [0144.593] CloseHandle (hObject=0x1f8) returned 1 [0144.595] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml.z49-css-qhb")) returned 0 [0144.595] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml.z49-css-qhb")) returned 0x20 [0144.596] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 0x7e2848 [0144.597] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0144.598] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0145.151] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0145.155] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3368, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0145.157] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.282] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.379] CloseHandle (hObject=0x1f8) returned 1 [0145.380] CloseHandle (hObject=0x1e8) returned 1 [0145.381] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml.z49-css-qhb")) returned 0 [0145.382] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml.z49-css-qhb")) returned 0x20 [0145.382] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 0x7e2bc8 [0145.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0145.383] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0145.652] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2964, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2964, lpOverlapped=0x0) returned 1 [0145.655] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2964, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2964, lpOverlapped=0x0) returned 1 [0145.657] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.705] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.726] CloseHandle (hObject=0x1e8) returned 1 [0145.727] CloseHandle (hObject=0x1f8) returned 1 [0145.730] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml.z49-css-qhb")) returned 0 [0145.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml.z49-css-qhb")) returned 0x20 [0145.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 0x7e26c8 [0145.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0145.733] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0145.856] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2964, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2964, lpOverlapped=0x0) returned 1 [0145.870] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2964, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2964, lpOverlapped=0x0) returned 1 [0145.872] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.068] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.123] CloseHandle (hObject=0x1f8) returned 1 [0146.124] CloseHandle (hObject=0x1e8) returned 1 [0146.125] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml.z49-css-qhb")) returned 0 [0146.125] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml.z49-css-qhb")) returned 0x20 [0146.125] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 0x7e2a48 [0146.169] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0146.170] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0146.338] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10b0f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10b0f, lpOverlapped=0x0) returned 1 [0146.343] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10b0f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10b0f, lpOverlapped=0x0) returned 1 [0146.348] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.419] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.460] CloseHandle (hObject=0x1e8) returned 1 [0146.460] CloseHandle (hObject=0x1f8) returned 1 [0146.465] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml.z49-css-qhb")) returned 0 [0146.465] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml.z49-css-qhb")) returned 0x20 [0146.465] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 0x7e2888 [0146.466] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0146.467] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0146.620] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10b0f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x10b0f, lpOverlapped=0x0) returned 1 [0146.628] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10b0f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x10b0f, lpOverlapped=0x0) returned 1 [0146.632] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.736] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.762] CloseHandle (hObject=0x1f8) returned 1 [0146.762] CloseHandle (hObject=0x1e8) returned 1 [0146.766] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml.z49-css-qhb")) returned 0 [0146.766] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml.z49-css-qhb")) returned 0x20 [0146.766] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 0x7e2848 [0146.768] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0146.768] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0147.015] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0147.068] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3368, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0147.071] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.122] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.147] CloseHandle (hObject=0x1e8) returned 1 [0147.147] CloseHandle (hObject=0x1f8) returned 1 [0147.148] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml.z49-css-qhb")) returned 0 [0147.149] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml.z49-css-qhb")) returned 0x20 [0147.159] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 0x7e2848 [0147.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0147.164] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0147.499] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3368, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0147.504] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3368, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3368, lpOverlapped=0x0) returned 1 [0147.507] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.599] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.670] CloseHandle (hObject=0x1f8) returned 1 [0147.670] CloseHandle (hObject=0x1e8) returned 1 [0147.672] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml.z49-css-qhb")) returned 0 [0147.672] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml.z49-css-qhb")) returned 0x20 [0147.672] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 0x7e2a48 [0147.674] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0147.675] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0148.015] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x100c3, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x100c3, lpOverlapped=0x0) returned 1 [0148.019] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x100c3, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x100c3, lpOverlapped=0x0) returned 1 [0148.022] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.150] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.176] CloseHandle (hObject=0x1e8) returned 1 [0148.176] CloseHandle (hObject=0x1f8) returned 1 [0148.179] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml.z49-css-qhb")) returned 0 [0148.180] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml.z49-css-qhb")) returned 0x20 [0148.180] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 0x7e2bc8 [0148.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0148.182] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0148.579] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x100c6, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x100c6, lpOverlapped=0x0) returned 1 [0148.582] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x100c6, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x100c6, lpOverlapped=0x0) returned 1 [0148.638] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.721] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.736] CloseHandle (hObject=0x1f8) returned 1 [0148.736] CloseHandle (hObject=0x1e8) returned 1 [0148.739] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml.z49-css-qhb")) returned 0 [0148.739] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml.z49-css-qhb")) returned 0x20 [0148.739] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 0x7e2848 [0148.740] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0148.740] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0149.094] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x506, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x506, lpOverlapped=0x0) returned 1 [0149.167] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x506, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x506, lpOverlapped=0x0) returned 1 [0149.169] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.244] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.266] CloseHandle (hObject=0x1e8) returned 1 [0149.267] CloseHandle (hObject=0x1f8) returned 1 [0149.268] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml.z49-css-qhb")) returned 0 [0149.268] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml.z49-css-qhb")) returned 0x20 [0149.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 0x7e2bc8 [0149.270] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0149.271] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0149.516] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x506, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x506, lpOverlapped=0x0) returned 1 [0149.559] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x506, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x506, lpOverlapped=0x0) returned 1 [0149.560] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.589] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.726] CloseHandle (hObject=0x1f8) returned 1 [0149.726] CloseHandle (hObject=0x1e8) returned 1 [0149.728] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml.z49-css-qhb")) returned 0 [0149.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml.z49-css-qhb")) returned 0x20 [0149.728] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 0x7e2608 [0149.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0149.730] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0150.024] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x509, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x509, lpOverlapped=0x0) returned 1 [0150.031] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x509, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x509, lpOverlapped=0x0) returned 1 [0150.033] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.114] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.129] CloseHandle (hObject=0x1e8) returned 1 [0150.130] CloseHandle (hObject=0x1f8) returned 1 [0150.131] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml.z49-css-qhb")) returned 0 [0150.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml.z49-css-qhb")) returned 0x20 [0150.131] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 0x7e2708 [0150.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0150.133] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0150.257] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x509, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x509, lpOverlapped=0x0) returned 1 [0150.308] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x509, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x509, lpOverlapped=0x0) returned 1 [0150.309] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.392] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.407] CloseHandle (hObject=0x1f8) returned 1 [0150.407] CloseHandle (hObject=0x1e8) returned 1 [0150.408] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml.z49-css-qhb")) returned 0 [0150.408] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml.z49-css-qhb")) returned 0x20 [0150.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 0x7e2a48 [0150.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0150.410] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0150.626] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb4b, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xb4b, lpOverlapped=0x0) returned 1 [0150.628] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb4b, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xb4b, lpOverlapped=0x0) returned 1 [0150.630] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.702] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.715] CloseHandle (hObject=0x1e8) returned 1 [0150.715] CloseHandle (hObject=0x1f8) returned 1 [0150.716] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml.z49-css-qhb")) returned 0 [0150.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml.z49-css-qhb")) returned 0x20 [0150.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 0x7e2b08 [0150.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0150.719] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0151.099] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb4b, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xb4b, lpOverlapped=0x0) returned 1 [0151.101] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb4b, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xb4b, lpOverlapped=0x0) returned 1 [0151.104] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.186] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.201] CloseHandle (hObject=0x1f8) returned 1 [0151.201] CloseHandle (hObject=0x1e8) returned 1 [0151.202] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml.z49-css-qhb")) returned 0 [0151.203] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml.z49-css-qhb")) returned 0x20 [0151.203] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 0x7e2a48 [0151.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0151.254] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0151.494] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3ed, lpOverlapped=0x0) returned 1 [0151.497] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3ed, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3ed, lpOverlapped=0x0) returned 1 [0151.498] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.582] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.595] CloseHandle (hObject=0x1e8) returned 1 [0151.595] CloseHandle (hObject=0x1f8) returned 1 [0151.596] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml.z49-css-qhb")) returned 0 [0151.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml.z49-css-qhb")) returned 0x20 [0151.597] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x5c, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 0x7e2c48 [0151.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0151.599] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0152.066] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x85f, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x85f, lpOverlapped=0x0) returned 1 [0152.075] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x85f, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x85f, lpOverlapped=0x0) returned 1 [0152.077] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.107] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.160] CloseHandle (hObject=0x1f8) returned 1 [0152.160] CloseHandle (hObject=0x1e8) returned 1 [0152.161] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml.z49-css-qhb")) returned 0 [0152.161] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml.z49-css-qhb")) returned 0x20 [0152.162] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 0x7e26c8 [0152.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0152.164] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0152.458] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd59, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xd59, lpOverlapped=0x0) returned 1 [0152.461] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd59, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xd59, lpOverlapped=0x0) returned 1 [0152.462] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.544] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.561] CloseHandle (hObject=0x1e8) returned 1 [0152.561] CloseHandle (hObject=0x1f8) returned 1 [0152.562] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml.z49-css-qhb")) returned 0 [0152.563] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml.z49-css-qhb")) returned 0x20 [0152.563] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 0x7e2608 [0152.577] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0152.578] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0152.867] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa2e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xa2e, lpOverlapped=0x0) returned 1 [0152.870] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa2e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xa2e, lpOverlapped=0x0) returned 1 [0152.871] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.017] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.031] CloseHandle (hObject=0x1f8) returned 1 [0153.031] CloseHandle (hObject=0x1e8) returned 1 [0153.032] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml.z49-css-qhb")) returned 0 [0153.033] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml.z49-css-qhb")) returned 0x20 [0153.033] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x5c, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 0x7e2a48 [0153.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0153.036] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0153.275] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x37c, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x37c, lpOverlapped=0x0) returned 1 [0153.318] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x37c, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x37c, lpOverlapped=0x0) returned 1 [0153.320] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.377] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.445] CloseHandle (hObject=0x1e8) returned 1 [0153.446] CloseHandle (hObject=0x1f8) returned 1 [0153.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml.z49-css-qhb")) returned 0 [0153.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml.z49-css-qhb")) returned 0x20 [0153.447] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="VdiState.xml", cAlternateFileName="")) returned 0x7e2848 [0153.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0153.452] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0153.700] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x930d0, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x930d0, lpOverlapped=0x0) returned 1 [0153.750] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x930d0, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x930d0, lpOverlapped=0x0) returned 1 [0153.768] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.855] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.872] CloseHandle (hObject=0x1ec) returned 1 [0153.873] CloseHandle (hObject=0x1f8) returned 1 [0154.095] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat.z49-css-qhb")) returned 0 [0154.097] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat.z49-css-qhb")) returned 0x20 [0154.097] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 0x7e2848 [0154.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0154.107] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0154.275] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x0, lpOverlapped=0x0) returned 1 [0154.275] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.310] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.376] CloseHandle (hObject=0x1f8) returned 1 [0154.376] CloseHandle (hObject=0x1ec) returned 1 [0154.376] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat.z49-css-qhb")) returned 0 [0154.378] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat.z49-css-qhb")) returned 0x20 [0154.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 0x7e2b08 [0154.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0154.380] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0154.619] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x93038, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x93038, lpOverlapped=0x0) returned 1 [0154.633] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x93038, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x93038, lpOverlapped=0x0) returned 1 [0154.727] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.822] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.840] CloseHandle (hObject=0x1ec) returned 1 [0154.840] CloseHandle (hObject=0x1f8) returned 1 [0154.856] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.z49-css-qhb")) returned 0 [0154.857] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.z49-css-qhb")) returned 0x20 [0154.857] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="guest.bmp", cAlternateFileName="")) returned 0x7e2908 [0155.053] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0155.053] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0155.170] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1518, lpOverlapped=0x0) returned 1 [0155.198] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1518, lpOverlapped=0x0) returned 1 [0155.200] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.232] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.266] CloseHandle (hObject=0x1f8) returned 1 [0155.266] CloseHandle (hObject=0x1ec) returned 1 [0155.270] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.z49-css-qhb")) returned 0 [0155.271] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.z49-css-qhb")) returned 0x20 [0155.271] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="guest.png", cAlternateFileName="")) returned 0x7e2608 [0155.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0155.777] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0155.986] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x967, lpOverlapped=0x0) returned 1 [0156.031] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x967, lpOverlapped=0x0) returned 1 [0156.033] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.065] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.109] CloseHandle (hObject=0x1ec) returned 1 [0156.110] CloseHandle (hObject=0x1f8) returned 1 [0156.111] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.z49-css-qhb")) returned 0 [0156.111] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.z49-css-qhb")) returned 0x20 [0156.111] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="user-192.png", cAlternateFileName="")) returned 0x7e2b48 [0156.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0156.114] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0156.234] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x19f, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x19f, lpOverlapped=0x0) returned 1 [0156.294] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x19f, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x19f, lpOverlapped=0x0) returned 1 [0156.296] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.328] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.390] CloseHandle (hObject=0x1f8) returned 1 [0156.391] CloseHandle (hObject=0x1ec) returned 1 [0156.392] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.z49-css-qhb")) returned 0 [0156.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.z49-css-qhb")) returned 0x20 [0156.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="user-32.png", cAlternateFileName="")) returned 0x7e2a48 [0156.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0156.394] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0156.612] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1b1, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1b1, lpOverlapped=0x0) returned 1 [0156.615] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1b1, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1b1, lpOverlapped=0x0) returned 1 [0156.616] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.641] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.704] CloseHandle (hObject=0x1ec) returned 1 [0156.705] CloseHandle (hObject=0x1f8) returned 1 [0156.706] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.z49-css-qhb")) returned 0 [0156.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.z49-css-qhb")) returned 0x20 [0156.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="user-40.png", cAlternateFileName="")) returned 0x7e2908 [0156.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0156.710] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0157.267] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1f5, lpOverlapped=0x0) returned 1 [0157.268] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1f5, lpOverlapped=0x0) returned 1 [0157.269] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.297] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.361] CloseHandle (hObject=0x1f8) returned 1 [0157.361] CloseHandle (hObject=0x1ec) returned 1 [0157.363] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.z49-css-qhb")) returned 0 [0157.363] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.z49-css-qhb")) returned 0x20 [0157.364] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="user-48.png", cAlternateFileName="")) returned 0x7e2688 [0157.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0157.367] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0157.552] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x93038, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x93038, lpOverlapped=0x0) returned 1 [0157.562] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x93038, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x93038, lpOverlapped=0x0) returned 1 [0157.574] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.648] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.662] CloseHandle (hObject=0x1ec) returned 1 [0157.662] CloseHandle (hObject=0x1f8) returned 1 [0157.740] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.z49-css-qhb")) returned 0 [0157.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.z49-css-qhb")) returned 0x20 [0157.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="user.bmp", cAlternateFileName="")) returned 0x7e2c08 [0157.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0157.750] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0158.104] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1518, lpOverlapped=0x0) returned 1 [0158.105] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1518, lpOverlapped=0x0) returned 1 [0158.107] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.139] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.217] CloseHandle (hObject=0x1f8) returned 1 [0158.218] CloseHandle (hObject=0x1ec) returned 1 [0158.218] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.z49-css-qhb")) returned 0 [0158.219] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.z49-css-qhb")) returned 0x20 [0158.219] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="user.png", cAlternateFileName="")) returned 0x7e2508 [0158.227] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.228] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d4f8ee, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x91d4f8ee, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x91d4f8ee, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="1527C7~1.XML")) returned 0x7e2a48 [0158.229] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.z49-css-qhb")) returned 0 [0158.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm.xml.z49-css-qhb")) returned 0xffffffff [0158.229] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2176a3b0, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2176a3b0, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2189b6d0, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm.xml", cAlternateFileName="9E2F88~1.XML")) returned 0x7e2a48 [0158.231] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935998d9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x935998d9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x935998d9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xbe9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="C5E252~1.XML")) returned 0x7e2a48 [0158.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9402e007, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9402e007, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9402e007, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1261, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="CORTAN~1.XML")) returned 0x7e2a88 [0158.234] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94b81300, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x94b81300, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x94b81300, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1a4b, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="DESKTO~1.XML")) returned 0x7e26c8 [0158.235] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95530c1d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x95530c1d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x95530c1d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="DESKTO~2.XML")) returned 0x7e26c8 [0158.241] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960d03e8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x960d03e8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x960d03e8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="E2A4F9~1.XML")) returned 0x7e2548 [0158.242] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.243] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.243] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8ad52, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x96b8ad52, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x96b8ad52, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="ENVIRO~1.XML")) returned 0x7e2688 [0158.244] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.245] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.245] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9775076f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9775076f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9775076f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2443, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy.xml", cAlternateFileName="HOLOCA~1.XML")) returned 0x7e2848 [0158.287] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x982a3a59, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x982a3a59, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x982a3a59, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy.xml", cAlternateFileName="HOLOIT~1.XML")) returned 0x7e2688 [0158.289] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.289] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98dd0af7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x98dd0af7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x98dd0af7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x67ed, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="HOLOSH~1.XML")) returned 0x7e2688 [0158.290] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.290] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbfc5d3, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xefbfc5d3, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xefbfc5d3, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x3ff1, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI0C82~1.XML")) returned 0x7e2b48 [0158.291] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.291] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.292] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb36a65a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb36a65a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb36a65a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe.xml", cAlternateFileName="MI064A~1.XML")) returned 0x7e2848 [0158.292] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.292] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb38bc697, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb38bc697, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb38bc697, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe.xml", cAlternateFileName="MI615A~1.XML")) returned 0x7e2a88 [0158.293] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.293] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30b0778, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb30b0778, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb30b0778, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x46bd, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIE657~1.XML")) returned 0x7e2848 [0158.294] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.295] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb34b6700, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb34b6700, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb34b6700, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4032~1.XML")) returned 0x7e2888 [0158.302] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.303] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9999651d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9999651d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9999651d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MICROS~1.XML")) returned 0x7e2848 [0158.303] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4049eb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9a4049eb, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9a4049eb, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3678, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MICROS~2.XML")) returned 0x7e2848 [0158.305] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4861de0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4861de0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4861de0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIC406~1.XML")) returned 0x7e2688 [0158.306] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.306] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50e0420, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb50e0420, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb50e0420, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI930E~1.XML")) returned 0x7e2848 [0158.307] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a70a46, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf0a70a46, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf0ae31f1, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe.xml", cAlternateFileName="MID251~1.XML")) returned 0x7e2908 [0158.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf080e498, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf080e498, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf080e498, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIB577~1.XML")) returned 0x7e2688 [0158.309] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b7dd80, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd2b7dd80, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd2b7dd80, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI5448~1.XML")) returned 0x7e2c08 [0158.310] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c06024, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf1c06024, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf1c06024, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x65eb, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI8EAA~1.XML")) returned 0x7e2848 [0158.311] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.311] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.311] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1fbfb11, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf1fbfb11, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf1fbfb11, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIE223~1.XML")) returned 0x7e2a48 [0158.312] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.312] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4270832, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd4270832, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd4270832, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.BingNews_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI29A4~1.XML")) returned 0x7e2688 [0158.313] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2cdca4e, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf2cdca4e, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf2cdca4e, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x643a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI61C2~1.XML")) returned 0x7e2c08 [0158.314] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30702c7, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf30702c7, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf30702c7, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIA5ED~1.XML")) returned 0x7e2688 [0158.315] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.315] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf41b9410, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf41b9410, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf41b9410, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x650b, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI06CF~1.XML")) returned 0x7e2708 [0158.316] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.316] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.316] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46a41c8, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf46a41c8, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf46a41c8, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x2088, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI83E9~1.XML")) returned 0x7e2a48 [0158.318] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.318] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb74a395d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb74a395d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb74a395d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI9E16~1.XML")) returned 0x7e2ac8 [0158.319] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.319] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76dfcd5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb76dfcd5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb76dfcd5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MIEDB5~1.XML")) returned 0x7e2848 [0158.320] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.320] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e3b40e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb6e3b40e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb6e3b40e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x7511, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID8D3~1.XML")) returned 0x7e2908 [0158.321] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.321] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7267611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7267611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7267611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x26ad, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIC7E0~1.XML")) returned 0x7e2c08 [0158.387] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.387] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a03408, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf5a03408, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf5a03408, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF36F~1.XML")) returned 0x7e2bc8 [0158.388] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.388] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af0b81d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9af0b81d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9af0b81d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MICROS~3.XML")) returned 0x7e2848 [0158.389] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.389] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.389] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf70372ea, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf70372ea, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf70372ea, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x39a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI2ED2~1.XML")) returned 0x7e2a48 [0158.390] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.390] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.390] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a414cd, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf6a414cd, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf6a414cd, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4306, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID396~1.XML")) returned 0x7e2848 [0158.391] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.391] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e211e4, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf6e211e4, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf6e211e4, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x276d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2880~1.XML")) returned 0x7e2688 [0158.392] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b8a5d5, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf7b8a5d5, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf7bb08dc, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x726b, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI9710~1.XML")) returned 0x7e2848 [0158.392] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7ed19a3, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf7ed19a3, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf7ed19a3, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI426C~1.XML")) returned 0x7e2848 [0158.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.393] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b99ff66, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9b99ff66, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9b99ff66, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x717, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MICROS~4.XML")) returned 0x7e2688 [0158.394] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.394] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e1ec23, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb8e1ec23, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb8e1ec23, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI2012~1.XML")) returned 0x7e2908 [0158.395] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.395] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.395] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fe88c8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb8fe88c8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb8fe88c8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MIDFEB~1.XML")) returned 0x7e2908 [0158.396] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.396] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c54fe1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb8c54fe1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb8c54fe1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIDD39~1.XML")) returned 0x7e2848 [0158.396] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.396] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.desktopappinstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb890dc01, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb890dc01, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb890dc01, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4097, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI3B11~1.XML")) returned 0x7e2c88 [0158.397] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.397] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8ee980c, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xf8ee980c, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xf8ee980c, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x406d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF830~1.XML")) returned 0x7e2b48 [0158.416] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba9affd9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xba9affd9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xba9affd9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI1858~1.XML")) returned 0x7e2848 [0158.417] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.417] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.417] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba42c935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xba42c935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xba42c935, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x406d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI6E97~1.XML")) returned 0x7e2708 [0158.417] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.418] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.418] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba7e63a1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xba7e63a1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xba7e63a1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x15b7, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI709A~1.XML")) returned 0x7e2a48 [0158.418] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.418] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.418] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c565993, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9c565993, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9c565993, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8e6, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MIDE50~1.XML")) returned 0x7e2a48 [0158.419] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.419] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.419] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba6c7dc, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xfba6c7dc, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xfba6c7dc, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MI969C~1.XML")) returned 0x7e2ac8 [0158.425] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.425] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.425] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2143df, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xfb2143df, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xfb23a740, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x41a5, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI6857~1.XML")) returned 0x7e2a48 [0158.426] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.426] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.426] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcecaa41, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbcecaa41, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbcecaa41, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4246, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI7741~1.XML")) returned 0x7e2908 [0158.427] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.427] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.427] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4743c1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd4743c1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd4743c1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MI3B96~1.XML")) returned 0x7e2688 [0158.428] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.428] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd25e2d3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd25e2d3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd25e2d3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x7bc3, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI70B5~1.XML")) returned 0x7e2a48 [0158.428] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe81faba, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbe81faba, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbe81faba, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x1dde, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI88E8~1.XML")) returned 0x7e2ac8 [0158.429] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb1a9c0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbeb1a9c0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbeb1a9c0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2a17, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIC3B1~1.XML")) returned 0x7e2a48 [0158.430] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.430] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.430] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2828c5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9d2828c5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9d2828c5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x5276, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe.xml", cAlternateFileName="MID973~1.XML")) returned 0x7e2848 [0158.431] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.431] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e28d9c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc2e28d9c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc2e28d9c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x11c9, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4EC0~1.XML")) returned 0x7e2848 [0158.431] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.431] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd518d47, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xfd518d47, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xfd518d47, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIFAD6~1.XML")) returned 0x7e2bc8 [0158.432] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.432] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftofficehub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.432] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b2de74, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc2b2de74, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc2b2de74, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3e47, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI6B66~1.XML")) returned 0x7e2848 [0158.433] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.433] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.433] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc900f90c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc900f90c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc900f90c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIED02~1.XML")) returned 0x7e26c8 [0158.433] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.434] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91d956f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc91d956f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc91d956f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI1DCA~1.XML")) returned 0x7e2c08 [0158.434] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.434] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a8c1df, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc8a8c1df, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc8a8c1df, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI91E0~1.XML")) returned 0x7e2b88 [0158.435] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.435] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e1fa68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc8e1fa68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc8e1fa68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2187, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI5BAC~1.XML")) returned 0x7e2b88 [0158.436] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.436] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.436] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2117eac, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2117eac, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x2117eac, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIF40C~1.XML")) returned 0x7e2688 [0158.436] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.437] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.437] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190bf51, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x190bf51, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x190bf51, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x3fec, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI867D~1.XML")) returned 0x7e2a48 [0158.496] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.496] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.497] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad90b53, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcad90b53, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcad90b53, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI6961~1.XML")) returned 0x7e2848 [0158.497] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.497] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaf5a798, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcaf5a798, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcaf5a798, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI982A~1.XML")) returned 0x7e2b08 [0158.498] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.498] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7e71d9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xca7e71d9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xca7e71d9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x402d, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI12BF~1.XML")) returned 0x7e2848 [0158.499] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.499] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab54806, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcab54806, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcab54806, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x430e, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI3326~1.XML")) returned 0x7e2c48 [0158.499] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9ba879, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcc9ba879, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcc9ba879, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x145b, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI4DC3~1.XML")) returned 0x7e26c8 [0158.500] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccd01c3e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xccd01c3e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xccd28175, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xcb65, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2D39~1.XML")) returned 0x7e2688 [0158.502] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.502] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ecd72c, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2ecd72c, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x2ecd72c, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x48a, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI7CA0~1.XML")) returned 0x7e2708 [0158.502] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.502] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379822a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x379822a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x379822a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x48a, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIF965~1.XML")) returned 0x7e2708 [0158.504] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.504] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.504] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc8b4e7, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xedc8b4e7, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xedc8b4e7, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="")) returned 0x7e2a48 [0158.505] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.505] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.505] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4a5800, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xed4a5800, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xed4f1e3c, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="")) returned 0x7e2c08 [0158.506] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.506] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.506] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02f145b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb02f145b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb02f145b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIBA6D~1.XML")) returned 0x7e2bc8 [0158.507] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.507] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.507] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf28d149, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaf28d149, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaf28d149, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI1E33~1.XML")) returned 0x7e2c48 [0158.507] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.507] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.508] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10cf7e48, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x10cf7e48, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x10d90883, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI5605~1.XML")) returned 0x7e2b48 [0158.508] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.508] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.508] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e02f19, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x10e02f19, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x10e9b8f7, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI0EF0~1.XML")) returned 0x7e2848 [0158.509] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.509] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.509] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bc4411, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x3bc4411, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x3bc4411, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI55DD~1.XML")) returned 0x7e2a48 [0158.510] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.510] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.510] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fca3a6, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x3fca3a6, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x3fca3a6, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI1148~1.XML")) returned 0x7e2a48 [0158.510] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.511] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.511] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee71fcc9, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xee71fcc9, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xee71fcc9, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4a7, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIBB3D~1.XML")) returned 0x7e26c8 [0158.525] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.525] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.526] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1e89ae, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xee1e89ae, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xee1e89ae, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4a7, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIACC6~1.XML")) returned 0x7e2a48 [0158.527] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.527] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.527] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae038fa9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xae038fa9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xae038fa9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MID0EE~1.XML")) returned 0x7e2b88 [0158.528] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.528] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.528] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad5caae4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xad5caae4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad5caae4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIF877~1.XML")) returned 0x7e2908 [0158.529] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.529] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.529] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacfaea2e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xacfaea2e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xacfaea2e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI42D6~1.XML")) returned 0x7e2a48 [0158.530] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.530] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.530] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8fa04b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xac8fa04b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xac8fa04b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI163D~1.XML")) returned 0x7e2508 [0158.531] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.531] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac916d8, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1ac916d8, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x1ad502c4, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIB1EE~1.XML")) returned 0x7e2b48 [0158.532] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.533] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.net.native.runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.533] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad765f9, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1ad765f9, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x1ae5b39c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIB437~1.XML")) returned 0x7e2848 [0158.533] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.534] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.534] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1aa475a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd1aa475a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1aa475a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xb55e, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2979~1.XML")) returned 0x7e2908 [0158.535] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.535] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.535] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f0249f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x9f0249f, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x9f0249f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x3b9e, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI80C6~1.XML")) returned 0x7e2a48 [0158.569] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.570] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.onenote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.570] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1710ee0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd1710ee0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1710ee0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3ba0, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID962~1.XML")) returned 0x7e2a48 [0158.571] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.571] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.571] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45b128, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd45b128, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xd4813af, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x7bb2, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4B95~1.XML")) returned 0x7e2848 [0158.571] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.571] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.572] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce18ceb, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xce18ceb, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xce18ceb, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x2493, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI27BB~1.XML")) returned 0x7e2688 [0158.572] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.572] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.572] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f98f9a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd3f98f9a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd3f98f9a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI5F85~1.XML")) returned 0x7e2888 [0158.573] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.573] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.573] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd413c964, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd413c964, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd413c964, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MIFEEA~1.XML")) returned 0x7e2848 [0158.574] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.574] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.574] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd39ef5f2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd39ef5f2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd3a15864, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x68fe, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI2369~1.XML")) returned 0x7e2848 [0158.576] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.576] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.576] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3da90d7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd3da90d7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd3dcf302, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10f6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIE06B~1.XML")) returned 0x7e2888 [0158.577] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.577] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.577] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd627f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xedd627f, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xedd627f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI3D89~1.XML")) returned 0x7e2c08 [0158.586] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.586] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.586] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c81868, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd5c81868, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd5c81868, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIA5AC~1.XML")) returned 0x7e2508 [0158.587] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.587] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.587] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e4b4a3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd5e4b4a3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd5e4b4a3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI0647~1.XML")) returned 0x7e2688 [0158.588] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.588] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.588] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a919ca, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd5a919ca, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd5a919ca, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2eaa, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MICD15~1.XML")) returned 0x7e2a48 [0158.589] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.589] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.589] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe76dd55, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xe76dd55, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xe76dd55, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x40df, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIA62F~1.XML")) returned 0x7e2908 [0158.590] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.590] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.people_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.590] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd568ba49, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd568ba49, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd568ba49, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI19FE~1.XML")) returned 0x7e2848 [0158.591] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.591] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.591] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e05e3c6, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9e05e3c6, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9e05e3c6, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xe41, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MID218~1.XML")) returned 0x7e2848 [0158.592] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.592] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.592] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35e833ab, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x35e833ab, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x35f1bcbb, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1257, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIBE67~1.XML")) returned 0x7e26c8 [0158.593] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.593] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.593] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3610bbd4, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x3610bbd4, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x362d5827, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x1273, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIB7AE~1.XML")) returned 0x7e2c48 [0158.593] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0 [0158.593] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0xffffffff [0158.594] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdafa7ab4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdafa7ab4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdafcdd0a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c.xml", cAlternateFileName="MID4E6~1.XML")) returned 0x7e2a48 [0158.594] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0 [0158.594] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0xffffffff [0158.594] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb17170e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdb17170e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdb17170e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c.xml", cAlternateFileName="MIA52E~1.XML")) returned 0x7e2688 [0158.595] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0 [0158.595] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0xffffffff [0158.595] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda04e80d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xda04e80d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xda04e80d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x41ac, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c.xml", cAlternateFileName="MIE616~1.XML")) returned 0x7e2b88 [0158.595] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0 [0158.596] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0xffffffff [0158.596] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaba1b1c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdaba1b1c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdaba1b1c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x6af1, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c.xml", cAlternateFileName="MIFCF2~1.XML")) returned 0x7e26c8 [0158.596] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0 [0158.596] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml.z49-css-qhb")) returned 0xffffffff [0158.596] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb195c1, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xfb195c1, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0xfb3f81a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x3cfb, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c.xml", cAlternateFileName="MIF0DA~1.XML")) returned 0x7e2848 [0158.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.597] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa03211, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdfa03211, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfa03211, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIEEA6~1.XML")) returned 0x7e2c08 [0158.598] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.storepurchaseapp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d704f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdf5d704f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdf5d704f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x6557, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI65ED~1.XML")) returned 0x7e2a48 [0158.599] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecefbea4, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xecefbea4, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xecefbea4, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe.xml", cAlternateFileName="")) returned 0x7e2a88 [0158.601] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec6c9e5f, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xec6c9e5f, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xec6c9e5f, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe.xml", cAlternateFileName="")) returned 0x7e26c8 [0158.602] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.602] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefc44ac, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xeefc44ac, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xeefc44ac, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2A58~1.XML")) returned 0x7e26c8 [0158.607] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.608] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.608] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb982b6, ftCreationTime.dwHighDateTime=0x1d3271f, ftLastAccessTime.dwLowDateTime=0xeeb982b6, ftLastAccessTime.dwHighDateTime=0x1d3271f, ftLastWriteTime.dwLowDateTime=0xeeb982b6, ftLastWriteTime.dwHighDateTime=0x1d3271f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MI4CBD~1.XML")) returned 0x7e2688 [0158.608] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.609] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.609] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb127093f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb127093f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb127093f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4C29~1.XML")) returned 0x7e2708 [0158.610] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.610] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.vclibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.610] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c2e693, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb0c2e693, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb0c2e693, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe.xml", cAlternateFileName="MIF325~1.XML")) returned 0x7e2708 [0158.610] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.611] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.611] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe05eee78, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe05eee78, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe05eee78, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIE845~1.XML")) returned 0x7e2b08 [0158.611] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.612] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe07ded25, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe07ded25, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe07ded25, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x106a, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIAE89~1.XML")) returned 0x7e2848 [0158.613] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.613] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.613] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eaf2aff, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9eaf2aff, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9eaf2aff, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8e6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MI1F2E~1.XML")) returned 0x7e2708 [0158.662] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.662] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.662] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f4ee8c2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9f4ee8c2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9f4ee8c2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x802, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MIA925~1.XML")) returned 0x7e2a48 [0158.663] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.663] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.663] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff36b47, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9ff36b47, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9ff36b47, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3a3a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MIE6C6~1.XML")) returned 0x7e2848 [0158.664] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.664] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.664] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b227a4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa0b227a4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa0b227a4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3410, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MID405~1.XML")) returned 0x7e2a48 [0158.665] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.665] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.666] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa19709bd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa19709bd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa19709bd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x15b30, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MI7866~1.XML")) returned 0x7e2b88 [0158.666] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.666] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.667] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa360ce01, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa360ce01, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa360ce01, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MI77FD~1.XML")) returned 0x7e2a48 [0158.667] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.667] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.667] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa448128e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa448128e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa448128e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MIF125~1.XML")) returned 0x7e2bc8 [0158.668] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.668] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.668] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e30bb2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa4e30bb2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa4e30bb2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x7cd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MI08DC~1.XML")) returned 0x7e2848 [0158.669] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.669] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.669] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57218f7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa57218f7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa57218f7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MIF80E~1.XML")) returned 0x7e2a48 [0158.670] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.670] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.671] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62e72f2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa62e72f2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa62e72f2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8cb, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MI8AA5~1.XML")) returned 0x7e2848 [0158.671] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.671] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.672] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d85448, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x11d85448, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x11d85448, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MID69C~1.XML")) returned 0x7e2a88 [0158.682] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.682] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.682] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84e450e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe84e450e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe84e450e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI82CC~1.XML")) returned 0x7e2a88 [0158.683] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.683] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.683] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe831a8d9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe831a8d9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe831a8d9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xe9ff, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI28E3~1.XML")) returned 0x7e2848 [0158.684] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.684] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.684] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11506fcf, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x11506fcf, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x11506fcf, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x4642, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF109~1.XML")) returned 0x7e2c08 [0158.685] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.685] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.685] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7eee6e2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe7eee6e2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe7eee6e2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x43fa, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI557C~1.XML")) returned 0x7e2548 [0158.686] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.686] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.686] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b65928, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa6b65928, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa6b8bb81, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2465, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MI6E2E~1.XML")) returned 0x7e2b08 [0158.686] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.686] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.687] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747c8df, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa747c8df, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa747c8df, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MIBC22~1.XML")) returned 0x7e2a48 [0158.687] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.687] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.687] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c3c333, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa7c3c333, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa7c3c333, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xc90, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MIA68F~1.XML")) returned 0x7e2c88 [0158.688] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.688] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.688] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d0a79, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa86d0a79, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa86d0a79, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x684a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MIC1EB~1.XML")) returned 0x7e2bc8 [0158.689] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.689] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.689] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa905a137, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa905a137, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa905a137, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x591, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy.xml", cAlternateFileName="MI594B~1.XML")) returned 0x7e2a48 [0158.689] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.690] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.690] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b52b54, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x13b52b54, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x13b52b54, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI2890~1.XML")) returned 0x7e2c08 [0158.690] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2c9a83, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xeb2c9a83, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xeb2c9a83, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI58E8~1.XML")) returned 0x7e2ac8 [0158.691] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb52c04b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xeb52c04b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xeb52c04b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI87A1~1.XML")) returned 0x7e2688 [0158.693] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.693] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb0b3983, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xeb0b3983, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xeb0b3983, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x23b4, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI541D~1.XML")) returned 0x7e2a48 [0158.694] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.694] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x133df579, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x133df579, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x134057de, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x4761, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI591F~1.XML")) returned 0x7e2708 [0158.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsalarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead20126, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xead20126, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xead20126, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x464f, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIC720~1.XML")) returned 0x7e2a48 [0158.696] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x153041c1, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x153041c1, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x153041c1, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI0610~1.XML")) returned 0x7e2508 [0158.767] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.767] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.768] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0166b1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xee0166b1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xee0166b1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIC667~1.XML")) returned 0x7e26c8 [0158.769] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.770] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.770] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee20668f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xee20668f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xee20668f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MIF520~1.XML")) returned 0x7e2b48 [0158.771] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.771] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.771] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeddda3a3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xeddda3a3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xede005f9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xceb, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2F70~1.XML")) returned 0x7e2848 [0158.772] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.772] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.772] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d345da, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x14d345da, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x14d345da, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x4608, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID958~1.XML")) returned 0x7e2848 [0158.773] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.773] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.773] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3b830d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xed3b830d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xed3b830d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4585, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI7C81~1.XML")) returned 0x7e26c8 [0158.774] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.774] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.774] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16721fd2, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x16721fd2, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x16721fd2, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIE446~1.XML")) returned 0x7e2b48 [0158.774] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.774] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.775] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1619e88c, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x1619e88c, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1619e88c, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x466a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI9205~1.XML")) returned 0x7e2b88 [0158.775] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.775] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.775] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01e9d5a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf01e9d5a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf01e9d5a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x45e2, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MID340~1.XML")) returned 0x7e2a48 [0158.776] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.776] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.776] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf05a3855, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf05a3855, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf05a3855, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2979, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI2E54~1.XML")) returned 0x7e2688 [0158.777] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.777] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.777] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72911d8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf72911d8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf72911d8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x17e35, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIB99E~1.XML")) returned 0x7e2b88 [0158.777] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.778] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.778] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a37bb0c, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x1a37bb0c, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1a37bb0c, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x3cab, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI0C75~1.XML")) returned 0x7e2c08 [0158.778] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.778] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.778] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6c9b3b5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf6c9b3b5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf6cc15f9, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3bad, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="microsoft.windowscommunicationsapps_2015.7906.42257.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF2CD~1.XML")) returned 0x7e2b08 [0158.779] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.779] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.779] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf918fbca, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf918fbca, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf918fbca, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIE1B0~1.XML")) returned 0x7e2908 [0158.780] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.780] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.780] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf935980f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf935980f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf937fa5c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI1179~1.XML")) returned 0x7e2688 [0158.780] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.781] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.781] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8c326fc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf8c326fc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf8c326fc, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x48bb, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI91E9~1.XML")) returned 0x7e2708 [0158.781] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.782] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.782] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8f9fd23, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf8f9fd23, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf8f9fd23, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2007, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIEEFD~1.XML")) returned 0x7e2a48 [0158.790] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.791] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.791] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc70e96d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfc70e96d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfc70e96d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x40ed, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI3344~1.XML")) returned 0x7e2a48 [0158.791] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.791] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.792] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d245d28, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x1d245d28, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1d245d28, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI8D88~1.XML")) returned 0x7e2848 [0158.792] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.792] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.792] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd34d0b, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x1cd34d0b, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1cd34d0b, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x4717, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI8A58~1.XML")) returned 0x7e2848 [0158.793] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.793] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.793] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcd2a9cc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfcd2a9cc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfcd2a9cc, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI2971~1.XML")) returned 0x7e2c08 [0158.793] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.794] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcef4620, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfcef4620, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfcef4620, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI6A55~1.XML")) returned 0x7e2848 [0158.794] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.794] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb60d97, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfcb60d97, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfcb60d97, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x3b01, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI76CC~1.XML")) returned 0x7e2c48 [0158.795] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.795] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.795] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5e2ff8, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x1f5e2ff8, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1f5e2ff8, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x2ab3, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI38B3~1.XML")) returned 0x7e2688 [0158.796] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.796] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsphone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.796] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2c1e7f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x1f2c1e7f, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1f3cd08f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x14e9, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI0471~1.XML")) returned 0x7e2a48 [0158.796] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.797] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.797] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff45b563, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xff45b563, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xff45b563, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI14F3~1.XML")) returned 0x7e2b88 [0158.797] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.797] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.797] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff64b432, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xff64b432, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xff64b432, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI692E~1.XML")) returned 0x7e2848 [0158.798] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.798] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.798] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff0c7ccd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xff0c7ccd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xff0c7ccd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI412B~1.XML")) returned 0x7e2a88 [0158.799] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.799] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.799] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x204efde6, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x204efde6, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x204efde6, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x47ef, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIA050~1.XML")) returned 0x7e2a48 [0158.800] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.800] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowssoundrecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.800] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed5a684, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfed5a684, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfed5a684, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4657, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIE9D7~1.XML")) returned 0x7e2c48 [0158.800] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.800] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.801] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194fd9a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x194fd9a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x194fd9a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI0F05~1.XML")) returned 0x7e2b48 [0158.835] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.835] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.836] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1713a47, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1713a47, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1713a47, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x9334, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIA84B~1.XML")) returned 0x7e2688 [0158.836] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.836] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.837] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e7844, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x12e7844, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x12e7844, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x6ecb, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsStore_11701.1001.874.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI72C0~1.XML")) returned 0x7e2ac8 [0158.837] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.837] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.837] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2288d0c8, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2288d0c8, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x2288d0c8, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MI04D8~1.XML")) returned 0x7e2bc8 [0158.845] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.845] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.windowsstore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.845] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221d86b5, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x221d86b5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x221d86b5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x6f57, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIB07A~1.XML")) returned 0x7e2908 [0158.846] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.846] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.846] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24490ce4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x24490ce4, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x24490ce4, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x321e, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI2305~1.XML")) returned 0x7e2bc8 [0158.846] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.846] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.847] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe7f78, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3fe7f78, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3fe7f78, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x44a4, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.XboxApp_2017.113.1250.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI886C~1.XML")) returned 0x7e2848 [0158.847] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.847] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.847] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44f8fad, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x44f8fad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x44f8fad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI1A16~1.XML")) returned 0x7e2c48 [0158.849] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.849] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.849] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c2be2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x46c2be2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46c2be2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI630C~1.XML")) returned 0x7e2ac8 [0158.850] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.850] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.850] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43090de, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x43090de, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x432f340, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4a69, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIB3E4~1.XML")) returned 0x7e2688 [0158.850] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0158.851] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0158.851] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a55f00, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa9a55f00, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa9a55f00, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8de, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="MI250C~1.XML")) returned 0x7e2b88 [0158.851] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.851] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.851] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a4687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x58a4687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x58ca8d7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxGameOverlay_1.15.2003.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIBE3E~1.XML")) returned 0x7e2908 [0158.852] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.852] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.852] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c493c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x54c493c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x54c493c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIDC20~1.XML")) returned 0x7e2908 [0158.853] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.853] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.853] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b47da, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x56b47da, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x56daa01, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x128a, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI7225~1.XML")) returned 0x7e2908 [0158.854] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.854] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.854] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x654eec1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x654eec1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6575120, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x2269, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI4368~1.XML")) returned 0x7e2a48 [0158.854] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.855] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxidentityprovider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.855] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c66b6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x62c66b6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x62c66b6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x322a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxIdentityProvider_2016.719.1035.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI4E15~1.XML")) returned 0x7e2a48 [0158.855] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.855] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.855] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7245ba6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7245ba6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7245ba6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe.xml", cAlternateFileName="MIED8C~1.XML")) returned 0x7e2c48 [0158.856] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.856] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.856] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dcd4e1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6dcd4e1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6dcd4e1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI0207~1.XML")) returned 0x7e2688 [0158.857] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.857] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.857] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702faac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x702faac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7055cec, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI5B29~1.XML")) returned 0x7e2a48 [0158.858] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.858] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.858] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943f4a5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x943f4a5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x946571d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MI1C0B~1.XML")) returned 0x7e2688 [0158.858] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.859] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.859] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967b801, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x967b801, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x967b801, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MID31E~1.XML")) returned 0x7e2688 [0158.865] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.865] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.865] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986b6e6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x986b6e6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x986b6e6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MICDAF~1.XML")) returned 0x7e2c88 [0158.865] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.866] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.866] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924f65b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x924f65b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9275854, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3c3c, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MI7391~1.XML")) returned 0x7e2a48 [0158.866] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.866] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.866] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee1fd1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8ee1fd1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8ee1fd1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x463a, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI4EA6~1.XML")) returned 0x7e2a48 [0158.867] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.867] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.867] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55fe15a2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x55fe15a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x55fe15a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x6a9a, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI8783~1.XML")) returned 0x7e2bc8 [0158.871] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.871] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunemusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.871] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5653ea7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5653ea7b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5653ea7b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x351, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe.xml", cAlternateFileName="MI4748~1.XML")) returned 0x7e26c8 [0158.871] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.872] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.872] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd25d7, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xbdd25d7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbdd25d7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe.xml", cAlternateFileName="MIC0D8~1.XML")) returned 0x7e2b08 [0158.872] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.872] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.872] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc246c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xbfc246c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbfc246c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MI8EC4~1.XML")) returned 0x7e2a48 [0158.873] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.873] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.873] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b22fd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc1b22fd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc1b22fd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe.xml", cAlternateFileName="MI1F24~1.XML")) returned 0x7e2bc8 [0158.874] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.874] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.874] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe2734, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xbbe2734, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbbe2734, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x38a0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe.xml", cAlternateFileName="MIFDDE~1.XML")) returned 0x7e2b88 [0158.875] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.875] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb828c64, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb828c64, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb828c64, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x45dc, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MI0C0E~1.XML")) returned 0x7e2b88 [0158.875] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.876] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f12518, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x28f12518, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x28f12518, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x6836, dwReserved0=0x0, dwReserved1=0x88, cFileName="Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe.xml", cAlternateFileName="MIF26A~1.XML")) returned 0x7e2a48 [0158.876] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0 [0158.876] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\microsoft.zunevideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml.z49-css-qhb")) returned 0xffffffff [0158.876] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29685ad3, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x29685ad3, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x29685ad3, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe.xml", cAlternateFileName="MI57E7~1.XML")) returned 0x7e2b88 [0158.992] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0158.993] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0158.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92ab8e66, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x92d678ec, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x92d678ec, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0158.996] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.z49-css-qhb")) returned 0 [0158.996] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\9e2f88e3.twitter_5.7.1.0_x86__wgeqdkkx372wm\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0158.996] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8bdb3c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeecc3a86, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xeecc3a86, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2ac8 [0158.999] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0158.999] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0158.999] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937d5c45, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9397974f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9397974f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.002] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.003] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\cortanalistenuiapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.003] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9434f19e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9458b659, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9458b659, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.005] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.005] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktoplearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.005] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94dbd688, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x94f8733f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x94f8733f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2908 [0159.008] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.008] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\desktopview_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.008] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9589e2b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x95a8e193, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x95a8e193, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.012] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.012] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.012] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9643d9da, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x96607768, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x96607768, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2708 [0159.015] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.015] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\environmentsapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f44844, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x971cd135, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x971cd135, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2548 [0159.018] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holocamera_1.0.0.5_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x979ff208, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x97c87a8c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x97c87a8c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.020] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.021] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoitemplayerapp_1.0.0.2_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.021] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98578757, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9871c299, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9871c299, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c88 [0159.024] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\holoshell_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.024] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\HoloShell_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99164393, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x992e1c69, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x992e1c69, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2b48 [0159.027] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.027] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.027] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3da747c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3efea58, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3efea58, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.030] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.030] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.aad.brokerplugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.030] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c44fe8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x99d9c5e2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x99d9c5e2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.070] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.070] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.accountscontrol_10.0.15063.447_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.070] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a6b3474, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9a856fb3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9a856fb3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c08 [0159.073] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.073] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.074] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a77f1b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xda3590b5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda3590b5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2708 [0159.081] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.advertising.xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb525dbcb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xda037eac, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda037eac, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c08 [0159.085] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.086] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.086] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1418bc9, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd1523c44, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd1523c44, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2508 [0159.090] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.090] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.090] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2f5dac8, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd30428dd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd30428dd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2bc8 [0159.213] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.214] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45b7c01, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd46e8f54, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd46e8f54, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c48 [0159.224] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.224] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5773441, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd58f0bf8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd58f0bf8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b0beeb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe5f00f7a, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xb7c634a4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2ac8 [0159.236] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bioenrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b1ba403, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9b337bc4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9b337bc4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2b88 [0159.240] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d34c04, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc7b8c94, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd6eb23ae, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c48 [0159.247] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7fd528e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd8106568, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd8106568, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2888 [0159.250] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.creddialoghost_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bcc1132, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9beb112c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9beb112c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2888 [0159.254] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.254] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.desktopappinstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.254] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb943ad1b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9592379, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9592379, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.352] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.352] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.352] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae4e8f0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbb0186a7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbb0186a7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.361] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.361] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.lockapp_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.361] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c814416, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9ca04442, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9ca04442, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.365] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.365] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.365] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd9ab677, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf1672668, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xbdb28f56, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.369] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.369] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoft3dviewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.369] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf005789, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbf15ccc3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbf15ccc3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2888 [0159.371] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.371] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftedge_40.15063.0.0_neutral__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.371] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7b9b7b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x372efb45, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x9d9f5ef0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2708 [0159.376] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.376] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_17.8010.5926.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.376] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3208b03, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xff956a0a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc338634a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2ac8 [0159.384] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.384] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.14.1181.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.384] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97f562c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc999916e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc999916e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2888 [0159.387] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.387] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftstickynotes_1.4.101.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.387] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb3f90f6, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb52a4b1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb52a4b1, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a88 [0159.390] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.390] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.mspaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.390] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd428da8, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd618ddd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd618ddd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.400] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.400] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_17.7668.58071.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.400] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fb5782, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd2a7013d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd2a7013d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.429] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45200be, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe470ff6d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe470ff6d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2708 [0159.435] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.oneconnect_2.1701.277.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.435] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4673bd2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd47a4ead, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd47a4ead, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.438] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.439] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_10.1.10531.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.439] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd629d8ff, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd641b08f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd641b08f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c48 [0159.443] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.443] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.ppiprojection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a57cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9e523003, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9e523003, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2548 [0159.446] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.446] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.446] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe51ca8ff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x89d03f94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x89d03f94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c08 [0159.453] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.453] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.services.store.engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.453] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59b05d5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x89e81739, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x89e81739, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2b88 [0159.454] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat.z49-css-qhb")) returned 0 [0159.454] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_11.8.204.0_x64__kzf8qxf38zg5c\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.454] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb6d4f6, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dd3e4fd, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xded0c5f6, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a88 [0159.458] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.458] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.storepurchaseapp_1.0.45.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdffacb9d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe0176941, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0176941, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2888 [0159.466] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.466] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0a67562, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfd7a94e9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe0be4ebe, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.470] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.470] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.apprep.chxapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.470] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eda16ee, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9ef450a8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9ef450a8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.506] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.506] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.506] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f750ea6, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x9f8a8638, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x9f8a8638, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.509] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.509] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.510] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa02a4184, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa0494177, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa0494177, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a88 [0159.510] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.511] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.511] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0dd1291, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d25d835, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xa100d6cd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.511] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.511] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.512] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d1c0b0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc387073, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa2f7e65c, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.515] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.515] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.holographicfirstrun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.515] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa39a069d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa3da667f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa3da667f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.517] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.518] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.modalsharepickerhost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.518] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa464af24, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa4814b6f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa4814b6f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2b88 [0159.520] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.521] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkcaptiveportal_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.521] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5046c96, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa519e262, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa519e262, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7fb9b8, dwReserved1=0x7fbd70, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2ac8 [0159.524] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.525] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.oobenetworkconnectionflow_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a68cbb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa5bc0230, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa5bc0230, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7fb9b8, dwReserved1=0x7fbd70, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2b88 [0159.528] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.528] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.528] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64fd3eb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa66084dd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa66084dd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7fb9b8, dwReserved1=0x7fbd70, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.532] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.532] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_16.511.8780.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e21752, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x5f2fec0d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe905dabe, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.536] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.536] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.sechealthui_10.0.15063.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.536] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6dee149, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa6ef9321, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa6ef9321, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2888 [0159.540] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.540] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa764658a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa7705271, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa7705271, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.586] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.586] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secureassessmentbrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.586] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7fa99ab, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa80b4a13, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa80b4a13, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2908 [0159.587] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.587] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.587] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa890cdd2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc0fe898, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa8b49131, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x7d8618, dwReserved1=0x7f9158, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.590] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.591] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.windowpicker_10.0.15063.332_neutral__cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.591] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa91b1671, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa9413d76, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa9413d76, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2548 [0159.594] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.594] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1702.333.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.594] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebc53164, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbac9a9a4, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xebe430b6, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.597] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8225c7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xee9c5fa3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xee9c5fa3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c08 [0159.601] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscamera_2017.125.40.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f793a3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf124e09e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf124e09e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.602] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.602] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a9d10d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcaae114, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xf7cd9517, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c08 [0159.607] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.608] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsfeedbackhub_1.1612.10312.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.608] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf986a825, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xf99e8059, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf99e8059, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.611] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.611] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsmaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.611] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5f5544, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x22908441, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfdf7ec1e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2508 [0159.614] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsphone_10.1510.9010.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.615] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea15d313, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcfc5f9b8, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xeaa01bb0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2c08 [0159.620] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.621] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowssoundrecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffae9d11, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xffc412b8, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xffc412b8, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2708 [0159.666] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.667] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsstore_11701.1001.87.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.667] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a816e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x194b81d5, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2371de1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.673] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.673] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxapp_25.25.13009.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.673] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c462f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9d615c7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4de9d36, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2708 [0159.676] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgamecallableui_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bf98e6, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa9d2abbd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xa9d2abbd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.679] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.679] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxgameoverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.679] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2ce86, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xbc7ea7a3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x5c843c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2a48 [0159.682] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.682] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxidentityprovider_11.19.19003.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.682] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fd924, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6954e90, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6954e90, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2b88 [0159.688] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.688] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.xboxspeechtotextoverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.688] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751a859, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x75ff6cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x75ff6cc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2bc8 [0159.691] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.zunemusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3724ef, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa47d75f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa47d75f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0 [0159.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.zunevideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75bc96, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc8ff6cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8ff6cc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2bc8 [0159.700] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.700] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa582fa1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaa726a44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaa726a44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2848 [0159.701] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.701] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.701] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaad1c7ce, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbe0e629b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xaae9a0ba, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2908 [0159.705] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab7185b9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xab7d7320, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xab7d7320, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e26c8 [0159.741] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0 [0159.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore.dat.z49-css-qhb")) returned 0xffffffff [0159.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe8bb71, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabf70b4d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xabf70b4d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 0x7e2bc8 [0159.742] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0159.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.contactsupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0159.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa261e29, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaa261e29, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaa261e29, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0xe09, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="WINDOW~1.XML")) returned 0x7e2c08 [0159.743] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0159.744] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0159.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd70d8dd2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd70d8dd2, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd70d8dd2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x88, cFileName="windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="WI5116~1.XML")) returned 0x7e2ac8 [0159.744] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0159.744] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0159.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaabc52d2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaabc52d2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaabc52d2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="WINDOW~2.XML")) returned 0x7e2848 [0159.745] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0159.745] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.miracastview_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0159.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3f7466, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xab3f7466, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xab3f7466, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x5da, dwReserved0=0x0, dwReserved1=0x88, cFileName="Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="WINDOW~3.XML")) returned 0x7e2688 [0159.746] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0 [0159.746] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\windows.printdialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml.z49-css-qhb")) returned 0xffffffff [0159.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabce8169, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabce8169, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xabce8169, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x610, dwReserved0=0x0, dwReserved1=0x88, cFileName="Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy.xml", cAlternateFileName="WINDOW~4.XML")) returned 0x7e2c48 [0159.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0159.747] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0159.851] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4317, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x4317, lpOverlapped=0x0) returned 1 [0159.855] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4317, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x4317, lpOverlapped=0x0) returned 1 [0159.856] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.990] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.002] CloseHandle (hObject=0x1ec) returned 1 [0160.002] CloseHandle (hObject=0x1f8) returned 1 [0160.004] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppxProvisioning.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\appxprovisioning.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppxProvisioning.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\appxprovisioning.xml.z49-css-qhb")) returned 0 [0160.005] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppxProvisioning.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\appxprovisioning.xml.z49-css-qhb")) returned 0x20 [0160.005] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppxProvisioning.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4e338, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc9b08d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xadc74e2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4317, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="AppxProvisioning.xml", cAlternateFileName="APPXPR~1.XML")) returned 0x7e2a48 [0160.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0160.008] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0160.190] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4000, lpOverlapped=0x0) returned 1 [0160.192] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4000, lpOverlapped=0x0) returned 1 [0160.193] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.218] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.264] CloseHandle (hObject=0x1ec) returned 1 [0160.264] CloseHandle (hObject=0x1e8) returned 1 [0160.265] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db.z49-css-qhb")) returned 0 [0160.266] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db.z49-css-qhb")) returned 0x20 [0160.266] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcabb97ad, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcabb97ad, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcabb97ad, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="cversions.0.db", cAlternateFileName="CVERSI~2.DB")) returned 0x7e2888 [0160.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0160.268] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0160.397] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4000, lpOverlapped=0x0) returned 1 [0160.398] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4000, lpOverlapped=0x0) returned 1 [0160.400] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.526] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.542] CloseHandle (hObject=0x1e8) returned 1 [0160.542] CloseHandle (hObject=0x1ec) returned 1 [0160.669] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.z49-css-qhb")) returned 0 [0160.670] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.z49-css-qhb")) returned 0x20 [0160.670] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e2f731c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e2f731c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e2f731c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 0x7e2a48 [0160.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0160.672] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0160.807] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0160.850] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0160.852] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.883] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.931] CloseHandle (hObject=0x1ec) returned 1 [0160.932] CloseHandle (hObject=0x1e8) returned 1 [0160.933] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0160.934] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{07ce7f5b-73f4-4bad-b449-5b3e959def86}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0161.070] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1fbc3a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcb1fbc3a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcb1fbc3a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{07CE7F5B-73F4-4BAD-B449-5B3E959DEF86}.2.ver0x0000000000000001.db", cAlternateFileName="{07CE7~1.DB")) returned 0x7e2b48 [0161.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0161.076] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0161.257] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0161.296] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0161.297] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.387] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.402] CloseHandle (hObject=0x1e8) returned 1 [0161.402] CloseHandle (hObject=0x1ec) returned 1 [0161.404] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0161.404] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2a2e4b23-55e7-4066-bf56-40a8c2acf003}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0161.404] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b10d2c, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x35b10d2c, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0x35b10d2c, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{2A2E4B23-55E7-4066-BF56-40A8C2ACF003}.2.ver0x0000000000000001.db", cAlternateFileName="{2A2E4~1.DB")) returned 0x7e2848 [0161.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0161.407] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0161.596] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0161.598] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0161.600] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.676] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.690] CloseHandle (hObject=0x1ec) returned 1 [0161.690] CloseHandle (hObject=0x1e8) returned 1 [0161.692] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db.z49-css-qhb")) returned 0 [0161.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000002.db.z49-css-qhb")) returned 0x20 [0161.693] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb949e979, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xb949e979, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xb949e979, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000002.db", cAlternateFileName="{427A2~2.DB")) returned 0x7e2848 [0161.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0161.695] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0162.127] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0162.129] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0162.130] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.211] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.223] CloseHandle (hObject=0x1e8) returned 1 [0162.223] CloseHandle (hObject=0x1ec) returned 1 [0162.224] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db.z49-css-qhb")) returned 0 [0162.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{427a2095-ced1-467f-8647-d13f664e7313}.2.ver0x0000000000000003.db.z49-css-qhb")) returned 0x20 [0162.224] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6097056, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf6097056, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf6097056, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{427A2095-CED1-467F-8647-D13F664E7313}.2.ver0x0000000000000003.db", cAlternateFileName="{427A2~3.DB")) returned 0x7e2ac8 [0162.227] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0162.227] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0162.397] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0162.399] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0162.402] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.507] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.522] CloseHandle (hObject=0x1ec) returned 1 [0162.522] CloseHandle (hObject=0x1e8) returned 1 [0162.523] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0162.524] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{599d1469-eb61-443b-9556-ee3aa24908da}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0162.524] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb29459b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcb29459b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcb29459b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{599D1469-EB61-443B-9556-EE3AA24908DA}.2.ver0x0000000000000001.db", cAlternateFileName="{599D1~1.DB")) returned 0x7e2a48 [0162.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0162.532] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0162.719] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0162.761] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0162.763] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.795] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.858] CloseHandle (hObject=0x1e8) returned 1 [0162.859] CloseHandle (hObject=0x1ec) returned 1 [0162.860] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0162.861] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{5b6db04b-b054-4120-9ee4-33a79ff53bc3}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0162.861] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ac488d, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x35ac488d, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0x35ac488d, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{5B6DB04B-B054-4120-9EE4-33A79FF53BC3}.2.ver0x0000000000000001.db", cAlternateFileName="{5B6DB~1.DB")) returned 0x7e2b48 [0162.863] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0162.863] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0163.191] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0163.193] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0163.195] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.271] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.286] CloseHandle (hObject=0x1ec) returned 1 [0163.286] CloseHandle (hObject=0x1e8) returned 1 [0163.287] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0163.288] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{696521d6-0c3c-47a9-8a08-62a21834d2f0}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0163.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a78445, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x35a78445, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0x35a78445, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{696521D6-0C3C-47A9-8A08-62A21834D2F0}.2.ver0x0000000000000001.db", cAlternateFileName="{69652~1.DB")) returned 0x7e2908 [0163.292] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0163.292] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0163.493] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x46070, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x46070, lpOverlapped=0x0) returned 1 [0163.558] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x46070, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x46070, lpOverlapped=0x0) returned 1 [0163.566] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.630] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.645] CloseHandle (hObject=0x1e8) returned 1 [0163.646] CloseHandle (hObject=0x1ec) returned 1 [0163.654] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db.z49-css-qhb")) returned 0 [0163.655] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000014.db.z49-css-qhb")) returned 0x20 [0163.655] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c9e091, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x40c9e091, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x40c9e091, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x46070, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000014.db", cAlternateFileName="{6AF06~1.DB")) returned 0x7e2b88 [0163.660] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0163.660] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0163.855] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x46070, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x46070, lpOverlapped=0x0) returned 1 [0163.904] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x46070, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x46070, lpOverlapped=0x0) returned 1 [0163.911] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.113] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.128] CloseHandle (hObject=0x1ec) returned 1 [0164.129] CloseHandle (hObject=0x1e8) returned 1 [0164.136] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db.z49-css-qhb")) returned 0 [0164.137] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000016.db.z49-css-qhb")) returned 0x20 [0164.137] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf60bd162, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf60bd162, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf60bd162, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x46070, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db", cAlternateFileName="{6AF06~2.DB")) returned 0x7e2888 [0164.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0164.139] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0164.432] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0164.434] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0164.435] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.503] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.515] CloseHandle (hObject=0x1e8) returned 1 [0164.515] CloseHandle (hObject=0x1ec) returned 1 [0164.517] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0164.517] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0164.518] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c77eb7, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x40c77eb7, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x40c77eb7, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000001.db", cAlternateFileName="{7BF8D~1.DB")) returned 0x7e2b88 [0164.520] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0164.520] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0164.790] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0164.791] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0164.793] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.863] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.876] CloseHandle (hObject=0x1ec) returned 1 [0164.876] CloseHandle (hObject=0x1e8) returned 1 [0164.877] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db.z49-css-qhb")) returned 0 [0164.877] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{7bf8dbd1-8ee0-446a-8d07-1d22e4418d9a}.2.ver0x0000000000000002.db.z49-css-qhb")) returned 0x20 [0164.878] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6070dbf, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf6070dbf, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf6070dbf, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{7BF8DBD1-8EE0-446A-8D07-1D22E4418D9A}.2.ver0x0000000000000002.db", cAlternateFileName="{7BF8D~2.DB")) returned 0x7e2508 [0164.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0164.880] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0165.175] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0165.176] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x418, lpOverlapped=0x0) returned 1 [0165.177] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.292] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.305] CloseHandle (hObject=0x1e8) returned 1 [0165.305] CloseHandle (hObject=0x1ec) returned 1 [0165.306] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0165.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{9961e15c-3f61-4fa0-9f93-f635907c374b}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0165.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2480d2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcb2480d2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcb2480d2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{9961E15C-3F61-4FA0-9F93-F635907C374B}.2.ver0x0000000000000001.db", cAlternateFileName="{9961E~1.DB")) returned 0x7e2608 [0165.369] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0165.369] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0165.688] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0165.701] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0165.702] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.727] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.787] CloseHandle (hObject=0x1ec) returned 1 [0165.788] CloseHandle (hObject=0x1e8) returned 1 [0165.795] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0165.796] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b8c80385-ead5-4543-9080-86ada8e81dd5}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0165.796] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1632b4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcb1632b4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcb1632b4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{B8C80385-EAD5-4543-9080-86ADA8E81DD5}.2.ver0x0000000000000001.db", cAlternateFileName="{B8C80~1.DB")) returned 0x7e2688 [0165.798] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0165.798] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0165.933] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x913d0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x913d0, lpOverlapped=0x0) returned 1 [0166.073] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x913d0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x913d0, lpOverlapped=0x0) returned 1 [0166.084] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.169] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.183] CloseHandle (hObject=0x1e8) returned 1 [0166.183] CloseHandle (hObject=0x1ec) returned 1 [0166.194] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0166.195] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0166.195] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e2f731c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e2f731c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e2f731c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x913d0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", cAlternateFileName="{DDF57~1.DB")) returned 0x7e2848 [0166.196] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0166.196] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0166.372] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0166.395] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4c0, lpOverlapped=0x0) returned 1 [0166.396] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.439] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.451] CloseHandle (hObject=0x1ec) returned 1 [0166.451] CloseHandle (hObject=0x1e8) returned 1 [0166.453] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0 [0166.454] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{e14796d4-f769-4aa4-85dc-e9ffe52aeeb4}.2.ver0x0000000000000001.db.z49-css-qhb")) returned 0x20 [0166.454] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35698620, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x35698620, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0x35698620, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="{E14796D4-F769-4AA4-85DC-E9FFE52AEEB4}.2.ver0x0000000000000001.db", cAlternateFileName="{E1479~1.DB")) returned 0x7e2c88 [0166.526] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0166.527] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0166.835] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc76, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0166.915] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc76, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0166.916] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.940] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.085] CloseHandle (hObject=0x1f4) returned 1 [0167.085] CloseHandle (hObject=0x1f0) returned 1 [0167.087] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.z49-css-qhb")) returned 0 [0167.087] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml.z49-css-qhb")) returned 0x20 [0167.087] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\02305155-8ac1-1189-ff55-b7119a53887c.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9246834, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xd9246834, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x11f29520, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="02305155-8ac1-1189-ff55-b7119a53887c.xml", cAlternateFileName="023051~1.XML")) returned 0x7e2888 [0167.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0167.090] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0167.299] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc97, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc97, lpOverlapped=0x0) returned 1 [0167.301] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc97, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc97, lpOverlapped=0x0) returned 1 [0167.302] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.327] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.339] CloseHandle (hObject=0x1f0) returned 1 [0167.339] CloseHandle (hObject=0x1f4) returned 1 [0167.425] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.z49-css-qhb")) returned 0 [0167.425] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.z49-css-qhb")) returned 0x20 [0167.425] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8bd085, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfb8bd085, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfb8bd085, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml", cAlternateFileName="03F897~1.XML")) returned 0x7e2c48 [0167.427] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0167.428] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0167.648] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc81, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc81, lpOverlapped=0x0) returned 1 [0167.649] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc81, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc81, lpOverlapped=0x0) returned 1 [0167.651] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.675] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.746] CloseHandle (hObject=0x1f4) returned 1 [0167.746] CloseHandle (hObject=0x1f0) returned 1 [0167.748] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.z49-css-qhb")) returned 0 [0167.749] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.z49-css-qhb")) returned 0x20 [0167.749] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0890ad2f-b74f-c384-f684-9c33f8f67924.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdc841a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xcdc841a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcdc841a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc81, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="0890ad2f-b74f-c384-f684-9c33f8f67924.xml", cAlternateFileName="0890AD~1.XML")) returned 0x7e2c08 [0167.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0167.751] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0168.044] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xaea, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xaea, lpOverlapped=0x0) returned 1 [0168.046] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xaea, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xaea, lpOverlapped=0x0) returned 1 [0168.047] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.072] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.134] CloseHandle (hObject=0x1f0) returned 1 [0168.134] CloseHandle (hObject=0x1f4) returned 1 [0168.135] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.z49-css-qhb")) returned 0 [0168.136] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml.z49-css-qhb")) returned 0x20 [0168.136] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\08961e67-fd90-a888-a0c1-ffdc19a3386f.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2c2ce9, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f2c2ce9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe4e92946, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xaea, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="08961e67-fd90-a888-a0c1-ffdc19a3386f.xml", cAlternateFileName="08961E~1.XML")) returned 0x7e2c08 [0168.139] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0168.139] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0168.373] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa46, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa46, lpOverlapped=0x0) returned 1 [0168.374] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa46, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa46, lpOverlapped=0x0) returned 1 [0168.376] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.400] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.464] CloseHandle (hObject=0x1f4) returned 1 [0168.465] CloseHandle (hObject=0x1f0) returned 1 [0168.467] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.z49-css-qhb")) returned 0 [0168.469] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.z49-css-qhb")) returned 0x20 [0168.469] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0a8c1492-65ca-6a01-de25-0e183559d10d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e6060f7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e6060f7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe698b3f0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="0a8c1492-65ca-6a01-de25-0e183559d10d.xml", cAlternateFileName="0A8C14~1.XML")) returned 0x7e2c48 [0168.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0168.475] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0168.667] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xad9, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xad9, lpOverlapped=0x0) returned 1 [0168.669] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xad9, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xad9, lpOverlapped=0x0) returned 1 [0168.671] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.696] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.745] CloseHandle (hObject=0x1f0) returned 1 [0168.745] CloseHandle (hObject=0x1f4) returned 1 [0168.749] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.z49-css-qhb")) returned 0 [0168.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml.z49-css-qhb")) returned 0x20 [0168.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7956cf0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe7956cf0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe7956cf0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xad9, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml", cAlternateFileName="0CB4EF~1.XML")) returned 0x7e2a88 [0168.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0168.753] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0168.932] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc6b, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc6b, lpOverlapped=0x0) returned 1 [0168.934] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc6b, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc6b, lpOverlapped=0x0) returned 1 [0168.935] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.006] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.081] CloseHandle (hObject=0x1f4) returned 1 [0169.081] CloseHandle (hObject=0x1f0) returned 1 [0169.082] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.z49-css-qhb")) returned 0 [0169.086] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.z49-css-qhb")) returned 0x20 [0169.086] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4548ff6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x4548ff6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x4548ff6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc6b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml", cAlternateFileName="13BA87~1.XML")) returned 0x7e2688 [0169.088] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0169.088] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0169.315] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdd8, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xdd8, lpOverlapped=0x0) returned 1 [0169.326] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdd8, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xdd8, lpOverlapped=0x0) returned 1 [0169.327] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.353] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.414] CloseHandle (hObject=0x1f0) returned 1 [0169.415] CloseHandle (hObject=0x1f4) returned 1 [0169.416] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.z49-css-qhb")) returned 0 [0169.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.z49-css-qhb")) returned 0x20 [0169.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7cb078, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xea7cb078, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xea7cb078, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xdd8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="1659a225-428e-84f0-ba52-5fb2b85d55b3.xml", cAlternateFileName="1659A2~1.XML")) returned 0x7e2608 [0169.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0169.419] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0169.537] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc76, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0169.637] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc76, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0169.639] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.667] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.679] CloseHandle (hObject=0x1f4) returned 1 [0169.679] CloseHandle (hObject=0x1f0) returned 1 [0169.682] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.z49-css-qhb")) returned 0 [0169.732] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml.z49-css-qhb")) returned 0x20 [0169.733] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1dae14df-4c42-28af-691e-10cc07a990b4.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7331f5, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xec7331f5, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xec759452, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="1dae14df-4c42-28af-691e-10cc07a990b4.xml", cAlternateFileName="1DAE14~1.XML")) returned 0x7e2b08 [0169.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0169.735] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0169.868] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa4a, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa4a, lpOverlapped=0x0) returned 1 [0169.870] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa4a, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa4a, lpOverlapped=0x0) returned 1 [0169.872] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.941] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.954] CloseHandle (hObject=0x1f0) returned 1 [0169.954] CloseHandle (hObject=0x1f4) returned 1 [0169.955] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.z49-css-qhb")) returned 0 [0169.956] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.z49-css-qhb")) returned 0x20 [0169.956] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e20015d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e20015d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8863ab4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml", cAlternateFileName="1E2259~1.XML")) returned 0x7e2b88 [0169.959] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0169.959] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0170.260] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xade, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xade, lpOverlapped=0x0) returned 1 [0170.281] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xade, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xade, lpOverlapped=0x0) returned 1 [0170.283] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.307] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.440] CloseHandle (hObject=0x1f4) returned 1 [0170.440] CloseHandle (hObject=0x1f0) returned 1 [0170.441] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.z49-css-qhb")) returned 0 [0170.442] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.z49-css-qhb")) returned 0x20 [0170.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\215f9712-9fca-a3f8-5b11-660eefc73b96.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dedefe5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dedefe5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe98259ba, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xade, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="215f9712-9fca-a3f8-5b11-660eefc73b96.xml", cAlternateFileName="215F97~1.XML")) returned 0x7e2a88 [0170.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0170.444] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0170.739] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc7c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0170.811] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0170.812] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.837] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.849] CloseHandle (hObject=0x1f0) returned 1 [0170.849] CloseHandle (hObject=0x1f4) returned 1 [0170.855] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.z49-css-qhb")) returned 0 [0170.855] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.z49-css-qhb")) returned 0x20 [0170.855] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2657f7c0-8294-58c3-f394-15fe18ba174a.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8863ab4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe8863ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe8863ab4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="2657f7c0-8294-58c3-f394-15fe18ba174a.xml", cAlternateFileName="2657F7~1.XML")) returned 0x7e2888 [0170.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0170.906] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0171.160] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc77, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc77, lpOverlapped=0x0) returned 1 [0171.191] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc77, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc77, lpOverlapped=0x0) returned 1 [0171.192] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.217] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.229] CloseHandle (hObject=0x1f4) returned 1 [0171.229] CloseHandle (hObject=0x1f0) returned 1 [0171.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.z49-css-qhb")) returned 0 [0171.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.z49-css-qhb")) returned 0x20 [0171.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91532c3, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf91532c3, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf91532c3, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="26943e1f-42ed-f190-2895-3bc2b8c4176d.xml", cAlternateFileName="26943E~1.XML")) returned 0x7e2a88 [0171.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0171.251] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0171.472] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xddd, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xddd, lpOverlapped=0x0) returned 1 [0171.601] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xddd, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xddd, lpOverlapped=0x0) returned 1 [0171.602] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.633] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.693] CloseHandle (hObject=0x1f0) returned 1 [0171.694] CloseHandle (hObject=0x1f4) returned 1 [0171.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.z49-css-qhb")) returned 0 [0171.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.z49-css-qhb")) returned 0x20 [0171.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7eb90, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfd7eb90, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfd7eb90, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="280b97f1-1f94-1458-c842-d18e2d1e05f9.xml", cAlternateFileName="280B97~1.XML")) returned 0x7e2bc8 [0171.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0171.698] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0171.807] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xae5, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xae5, lpOverlapped=0x0) returned 1 [0172.141] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xae5, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xae5, lpOverlapped=0x0) returned 1 [0172.143] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.173] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.231] CloseHandle (hObject=0x1f4) returned 1 [0172.232] CloseHandle (hObject=0x1f0) returned 1 [0172.233] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.z49-css-qhb")) returned 0 [0172.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\28502d06-9d29-8514-1e5d-64447116d798.xml.z49-css-qhb")) returned 0x20 [0172.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28502d06-9d29-8514-1e5d-64447116d798.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd3f7c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7ddd3f7c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xea7cb078, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xae5, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="28502d06-9d29-8514-1e5d-64447116d798.xml", cAlternateFileName="28502D~1.XML")) returned 0x7e2a88 [0172.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0172.236] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0172.500] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa3b, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa3b, lpOverlapped=0x0) returned 1 [0172.554] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa3b, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa3b, lpOverlapped=0x0) returned 1 [0172.555] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.631] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.646] CloseHandle (hObject=0x1f0) returned 1 [0172.646] CloseHandle (hObject=0x1f4) returned 1 [0172.648] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.z49-css-qhb")) returned 0 [0172.649] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml.z49-css-qhb")) returned 0x20 [0172.649] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\28748306-9f02-a5d7-6ded-4459fddadc31.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcef153, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dcef153, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xeb796a75, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa3b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="28748306-9f02-a5d7-6ded-4459fddadc31.xml", cAlternateFileName="287483~1.XML")) returned 0x7e2b88 [0172.652] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0172.652] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0172.944] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa45, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa45, lpOverlapped=0x0) returned 1 [0172.946] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa45, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa45, lpOverlapped=0x0) returned 1 [0172.948] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.022] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.036] CloseHandle (hObject=0x1f4) returned 1 [0173.038] CloseHandle (hObject=0x1f0) returned 1 [0173.039] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.z49-css-qhb")) returned 0 [0173.040] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml.z49-css-qhb")) returned 0x20 [0173.040] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7457cd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xec759452, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa45, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml", cAlternateFileName="2A3ADC~1.XML")) returned 0x7e2888 [0173.042] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0173.042] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0173.230] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa47, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa47, lpOverlapped=0x0) returned 1 [0173.297] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa47, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa47, lpOverlapped=0x0) returned 1 [0173.298] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.329] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.515] CloseHandle (hObject=0x1f0) returned 1 [0173.515] CloseHandle (hObject=0x1f4) returned 1 [0173.516] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.z49-css-qhb")) returned 0 [0173.517] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml.z49-css-qhb")) returned 0x20 [0173.517] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1b4b95, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee1b4b95, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee1b4b95, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml", cAlternateFileName="2CB494~1.XML")) returned 0x7e2908 [0173.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0173.520] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0173.635] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdb6, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xdb6, lpOverlapped=0x0) returned 1 [0173.679] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdb6, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xdb6, lpOverlapped=0x0) returned 1 [0173.680] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.704] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.716] CloseHandle (hObject=0x1f4) returned 1 [0173.716] CloseHandle (hObject=0x1f0) returned 1 [0173.717] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.z49-css-qhb")) returned 0 [0173.718] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.z49-css-qhb")) returned 0x20 [0173.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d0cfd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x23d0cfd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x23d0cfd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xdb6, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml", cAlternateFileName="38AE35~1.XML")) returned 0x7e2908 [0173.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0173.757] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0173.896] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xca8, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xca8, lpOverlapped=0x0) returned 1 [0173.946] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xca8, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xca8, lpOverlapped=0x0) returned 1 [0173.947] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.974] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.986] CloseHandle (hObject=0x1f0) returned 1 [0173.986] CloseHandle (hObject=0x1f4) returned 1 [0174.040] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.z49-css-qhb")) returned 0 [0174.040] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml.z49-css-qhb")) returned 0x20 [0174.040] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3bef1b80-1939-62a0-48e8-4b25b157e940.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb5d6de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfcb5d6de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfcb5d6de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="3bef1b80-1939-62a0-48e8-4b25b157e940.xml", cAlternateFileName="3BEF1B~1.XML")) returned 0x7e2a88 [0174.043] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0174.043] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0174.233] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc8c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc8c, lpOverlapped=0x0) returned 1 [0174.235] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc8c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc8c, lpOverlapped=0x0) returned 1 [0174.237] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.261] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.321] CloseHandle (hObject=0x1f4) returned 1 [0174.321] CloseHandle (hObject=0x1f0) returned 1 [0174.322] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.z49-css-qhb")) returned 0 [0174.323] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.z49-css-qhb")) returned 0x20 [0174.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e9efd0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10e9efd0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10e9efd0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc8c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml", cAlternateFileName="3C8C7E~1.XML")) returned 0x7e2888 [0174.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0174.325] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0174.619] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc76, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0174.622] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc76, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0174.624] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.655] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.702] CloseHandle (hObject=0x1f0) returned 1 [0174.703] CloseHandle (hObject=0x1f4) returned 1 [0174.705] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.z49-css-qhb")) returned 0 [0174.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml.z49-css-qhb")) returned 0x20 [0174.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1688d1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee1688d1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee1688d1, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml", cAlternateFileName="3D4098~1.XML")) returned 0x7e2c48 [0174.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0174.711] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0174.893] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xfc7, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xfc7, lpOverlapped=0x0) returned 1 [0174.894] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xfc7, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xfc7, lpOverlapped=0x0) returned 1 [0174.896] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.919] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.010] CloseHandle (hObject=0x1f4) returned 1 [0175.010] CloseHandle (hObject=0x1f0) returned 1 [0175.015] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.z49-css-qhb")) returned 0 [0175.015] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml.z49-css-qhb")) returned 0x20 [0175.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f73b48e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f73b48e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f8201b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xfc7, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml", cAlternateFileName="3E260C~1.XML")) returned 0x7e2708 [0175.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0175.018] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0175.124] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc98, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc98, lpOverlapped=0x0) returned 1 [0175.213] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc98, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc98, lpOverlapped=0x0) returned 1 [0175.214] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.238] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.252] CloseHandle (hObject=0x1f0) returned 1 [0175.252] CloseHandle (hObject=0x1f4) returned 1 [0175.253] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.z49-css-qhb")) returned 0 [0175.254] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.z49-css-qhb")) returned 0x20 [0175.254] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\3ebdb897-991b-934f-ee13-2ca21ed81938.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf116af2a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf116af2a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf116af2a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc98, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="3ebdb897-991b-934f-ee13-2ca21ed81938.xml", cAlternateFileName="3EBDB8~1.XML")) returned 0x7e2708 [0175.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0175.290] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0175.487] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc87, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc87, lpOverlapped=0x0) returned 1 [0175.584] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc87, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc87, lpOverlapped=0x0) returned 1 [0175.586] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.611] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.644] CloseHandle (hObject=0x1f4) returned 1 [0175.645] CloseHandle (hObject=0x1f0) returned 1 [0175.646] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.z49-css-qhb")) returned 0 [0175.647] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml.z49-css-qhb")) returned 0x20 [0175.647] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe97ff772, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe97ff772, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe97ff772, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc87, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml", cAlternateFileName="41A635~1.XML")) returned 0x7e2ac8 [0175.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0175.649] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0175.739] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdb6, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xdb6, lpOverlapped=0x0) returned 1 [0175.741] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdb6, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xdb6, lpOverlapped=0x0) returned 1 [0175.743] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.767] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.789] CloseHandle (hObject=0x1f0) returned 1 [0175.789] CloseHandle (hObject=0x1f4) returned 1 [0175.790] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.z49-css-qhb")) returned 0 [0175.791] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.z49-css-qhb")) returned 0x20 [0175.791] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b836c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x56b836c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x56b836c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xdb6, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="46a9b648-161a-6393-bdaf-a6ccb77a570d.xml", cAlternateFileName="46A9B6~1.XML")) returned 0x7e2c88 [0175.793] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0175.793] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0175.905] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa47, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa47, lpOverlapped=0x0) returned 1 [0175.912] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa47, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa47, lpOverlapped=0x0) returned 1 [0175.914] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.947] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.001] CloseHandle (hObject=0x1f4) returned 1 [0176.002] CloseHandle (hObject=0x1f0) returned 1 [0176.005] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.z49-css-qhb")) returned 0 [0176.017] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml.z49-css-qhb")) returned 0x20 [0176.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4ad5b311-485b-15cc-97e9-9adb84427d7b.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf014be5b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf014be5b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf014be5b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="4ad5b311-485b-15cc-97e9-9adb84427d7b.xml", cAlternateFileName="4AD5B3~1.XML")) returned 0x7e2888 [0176.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0176.020] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0176.119] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc81, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc81, lpOverlapped=0x0) returned 1 [0176.121] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc81, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc81, lpOverlapped=0x0) returned 1 [0176.122] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.162] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.177] CloseHandle (hObject=0x1f0) returned 1 [0176.177] CloseHandle (hObject=0x1f4) returned 1 [0176.179] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.z49-css-qhb")) returned 0 [0176.179] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.z49-css-qhb")) returned 0x20 [0176.180] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5f72a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xed5f72a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xed5f72a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc81, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml", cAlternateFileName="4C4ECB~1.XML")) returned 0x7e2c08 [0176.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0176.194] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0176.289] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa68, lpOverlapped=0x0) returned 1 [0176.291] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa68, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa68, lpOverlapped=0x0) returned 1 [0176.292] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.320] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.335] CloseHandle (hObject=0x1f4) returned 1 [0176.336] CloseHandle (hObject=0x1f0) returned 1 [0176.337] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.z49-css-qhb")) returned 0 [0176.338] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\517cfcaf-138b-1796-2cea-62892204250a.xml.z49-css-qhb")) returned 0x20 [0176.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\517cfcaf-138b-1796-2cea-62892204250a.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7de131, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7de131, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf17ba2b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="517cfcaf-138b-1796-2cea-62892204250a.xml", cAlternateFileName="517CFC~1.XML")) returned 0x7e2888 [0176.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0176.528] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0176.602] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa41, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa41, lpOverlapped=0x0) returned 1 [0176.608] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa41, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa41, lpOverlapped=0x0) returned 1 [0176.610] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.637] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.649] CloseHandle (hObject=0x1f0) returned 1 [0176.649] CloseHandle (hObject=0x1f4) returned 1 [0176.650] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.z49-css-qhb")) returned 0 [0176.653] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml.z49-css-qhb")) returned 0x20 [0176.653] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5390be10-79b5-dc50-bb32-91842c76e607.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf286a9f1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf286a9f1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf286a9f1, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa41, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="5390be10-79b5-dc50-bb32-91842c76e607.xml", cAlternateFileName="5390BE~1.XML")) returned 0x7e2c48 [0176.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0176.656] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0176.732] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc7c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0176.734] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0176.735] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.762] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.773] CloseHandle (hObject=0x1f4) returned 1 [0176.773] CloseHandle (hObject=0x1f0) returned 1 [0176.774] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.z49-css-qhb")) returned 0 [0176.775] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml.z49-css-qhb")) returned 0x20 [0176.775] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\54a30ac2-1ccf-60a8-6672-380af6008f3d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf385c53a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf385c53a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf385c53a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="54a30ac2-1ccf-60a8-6672-380af6008f3d.xml", cAlternateFileName="54A30A~1.XML")) returned 0x7e2888 [0176.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0176.778] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0176.923] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa4c, lpOverlapped=0x0) returned 1 [0177.048] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa4c, lpOverlapped=0x0) returned 1 [0177.049] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.080] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.106] CloseHandle (hObject=0x1f0) returned 1 [0177.106] CloseHandle (hObject=0x1f4) returned 1 [0177.108] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.z49-css-qhb")) returned 0 [0177.108] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml.z49-css-qhb")) returned 0x20 [0177.108] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\59e31519-5400-7696-2a00-b5fca5ba8904.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf388279b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf388279b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf388279b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="59e31519-5400-7696-2a00-b5fca5ba8904.xml", cAlternateFileName="59E315~1.XML")) returned 0x7e2908 [0177.111] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0177.112] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0177.218] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa46, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa46, lpOverlapped=0x0) returned 1 [0177.220] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa46, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa46, lpOverlapped=0x0) returned 1 [0177.221] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.257] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.272] CloseHandle (hObject=0x1f4) returned 1 [0177.273] CloseHandle (hObject=0x1f0) returned 1 [0177.274] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.z49-css-qhb")) returned 0 [0177.275] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml.z49-css-qhb")) returned 0x20 [0177.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5b0a39aa-16e0-a938-f694-656664c7be15.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d8c2f73, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d8c2f73, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf4afcc60, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="5b0a39aa-16e0-a938-f694-656664c7be15.xml", cAlternateFileName="5B0A39~1.XML")) returned 0x7e2a88 [0177.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0177.278] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0177.489] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc97, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc97, lpOverlapped=0x0) returned 1 [0177.492] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc97, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc97, lpOverlapped=0x0) returned 1 [0177.493] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.524] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.545] CloseHandle (hObject=0x1f0) returned 1 [0177.546] CloseHandle (hObject=0x1f4) returned 1 [0177.547] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.z49-css-qhb")) returned 0 [0177.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml.z49-css-qhb")) returned 0x20 [0177.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5dd8bcf1-73af-cff8-d142-0ca7feade752.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd7b5b8, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfdd7b5b8, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfdd7b5b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="5dd8bcf1-73af-cff8-d142-0ca7feade752.xml", cAlternateFileName="5DD8BC~1.XML")) returned 0x7e2a88 [0177.550] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0177.550] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0177.732] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdcc, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xdcc, lpOverlapped=0x0) returned 1 [0177.749] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdcc, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xdcc, lpOverlapped=0x0) returned 1 [0177.751] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.789] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.804] CloseHandle (hObject=0x1f4) returned 1 [0177.804] CloseHandle (hObject=0x1f0) returned 1 [0177.806] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.z49-css-qhb")) returned 0 [0177.806] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml.z49-css-qhb")) returned 0x20 [0177.806] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\5f3c8956-0358-1f87-eb47-697e265d6aa9.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7930a89, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe7930a89, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe7930a89, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xdcc, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="5f3c8956-0358-1f87-eb47-697e265d6aa9.xml", cAlternateFileName="5F3C89~1.XML")) returned 0x7e2b88 [0177.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0177.817] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0178.069] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc76, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0178.071] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc76, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0178.072] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.145] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.160] CloseHandle (hObject=0x1f0) returned 1 [0178.160] CloseHandle (hObject=0x1f4) returned 1 [0178.161] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.z49-css-qhb")) returned 0 [0178.162] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml.z49-css-qhb")) returned 0x20 [0178.162] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\600364a7-e11c-efda-2c12-eac40e75f19a.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf49f1b92, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf49f1b92, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf49f1b92, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="600364a7-e11c-efda-2c12-eac40e75f19a.xml", cAlternateFileName="600364~1.XML")) returned 0x7e2888 [0178.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0178.165] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0178.273] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc82, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc82, lpOverlapped=0x0) returned 1 [0178.334] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc82, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc82, lpOverlapped=0x0) returned 1 [0178.336] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.425] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.449] CloseHandle (hObject=0x1f4) returned 1 [0178.449] CloseHandle (hObject=0x1f0) returned 1 [0178.451] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.z49-css-qhb")) returned 0 [0178.451] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.z49-css-qhb")) returned 0x20 [0178.451] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cb83c7, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf5cb83c7, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5cb83c7, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="61b5bd89-4cb0-db77-6622-cb63b5a58080.xml", cAlternateFileName="61B5BD~1.XML")) returned 0x7e2508 [0178.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0178.455] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0178.540] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc97, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc97, lpOverlapped=0x0) returned 1 [0178.543] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc97, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc97, lpOverlapped=0x0) returned 1 [0178.544] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.583] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.598] CloseHandle (hObject=0x1f0) returned 1 [0178.598] CloseHandle (hObject=0x1f4) returned 1 [0178.599] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.z49-css-qhb")) returned 0 [0178.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.z49-css-qhb")) returned 0x20 [0178.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffedc521, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xffedc521, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xffedc521, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml", cAlternateFileName="630A70~1.XML")) returned 0x7e2548 [0178.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0178.603] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0178.689] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa52, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa52, lpOverlapped=0x0) returned 1 [0178.691] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa52, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa52, lpOverlapped=0x0) returned 1 [0178.693] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.732] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.748] CloseHandle (hObject=0x1f4) returned 1 [0178.748] CloseHandle (hObject=0x1f0) returned 1 [0178.750] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.z49-css-qhb")) returned 0 [0178.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.z49-css-qhb")) returned 0x20 [0178.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\67447b0c-05cf-6740-5f7b-391ab440c42d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df516f3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7df516f3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf5cb83c7, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="67447b0c-05cf-6740-5f7b-391ab440c42d.xml", cAlternateFileName="67447B~1.XML")) returned 0x7e2b08 [0178.752] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0178.753] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0178.995] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa7e, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa7e, lpOverlapped=0x0) returned 1 [0178.997] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa7e, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa7e, lpOverlapped=0x0) returned 1 [0178.998] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.022] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.060] CloseHandle (hObject=0x1f0) returned 1 [0179.061] CloseHandle (hObject=0x1f4) returned 1 [0179.063] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.z49-css-qhb")) returned 0 [0179.064] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.z49-css-qhb")) returned 0x20 [0179.064] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e0cee88, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e0cee88, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf7e4055d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa7e, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml", cAlternateFileName="71C8F3~1.XML")) returned 0x7e2688 [0179.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0179.067] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0179.217] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc9d, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc9d, lpOverlapped=0x0) returned 1 [0179.219] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc9d, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc9d, lpOverlapped=0x0) returned 1 [0179.220] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.290] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.306] CloseHandle (hObject=0x1f4) returned 1 [0179.306] CloseHandle (hObject=0x1f0) returned 1 [0179.322] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.z49-css-qhb")) returned 0 [0179.323] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.z49-css-qhb")) returned 0x20 [0179.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac64cd3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xac64cd3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xac64cd3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="71ef3df1-f4b1-69cd-793a-48e165e282aa.xml", cAlternateFileName="71EF3D~1.XML")) returned 0x7e2708 [0179.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0179.326] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0179.658] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa47, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa47, lpOverlapped=0x0) returned 1 [0179.660] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa47, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa47, lpOverlapped=0x0) returned 1 [0179.662] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.705] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.723] CloseHandle (hObject=0x1f0) returned 1 [0179.723] CloseHandle (hObject=0x1f4) returned 1 [0179.734] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.z49-css-qhb")) returned 0 [0179.735] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.z49-css-qhb")) returned 0x20 [0179.735] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d850833, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d850833, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf917951d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml", cAlternateFileName="730908~1.XML")) returned 0x7e2c48 [0179.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0179.738] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0179.878] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc7c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0179.880] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0179.882] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.913] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.960] CloseHandle (hObject=0x1f4) returned 1 [0179.960] CloseHandle (hObject=0x1f0) returned 1 [0179.961] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.z49-css-qhb")) returned 0 [0179.962] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.z49-css-qhb")) returned 0x20 [0179.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1302615f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="7646fa0f-b52c-71a8-3aed-950dd1668c09.xml", cAlternateFileName="7646FA~1.XML")) returned 0x7e2a88 [0179.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0179.965] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0180.171] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa64, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa64, lpOverlapped=0x0) returned 1 [0180.172] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa64, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa64, lpOverlapped=0x0) returned 1 [0180.174] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.199] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.211] CloseHandle (hObject=0x1f0) returned 1 [0180.212] CloseHandle (hObject=0x1f4) returned 1 [0180.237] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.z49-css-qhb")) returned 0 [0180.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.z49-css-qhb")) returned 0x20 [0180.237] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1677f3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e1677f3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfb8e32db, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="8292682a-6850-c06c-9b6d-9646f16d4ed0.xml", cAlternateFileName="829268~1.XML")) returned 0x7e2bc8 [0180.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0180.239] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0180.404] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb00, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xb00, lpOverlapped=0x0) returned 1 [0180.406] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xb00, lpOverlapped=0x0) returned 1 [0180.407] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.442] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.520] CloseHandle (hObject=0x1f4) returned 1 [0180.520] CloseHandle (hObject=0x1f0) returned 1 [0180.522] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.z49-css-qhb")) returned 0 [0180.523] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.z49-css-qhb")) returned 0x20 [0180.523] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e4fb076, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e4fb076, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfcdbfc63, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xb00, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="865e8f30-20a1-9528-bb48-42999b5b2aa8.xml", cAlternateFileName="865E8F~1.XML")) returned 0x7e2608 [0180.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0180.537] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0180.635] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xadf, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xadf, lpOverlapped=0x0) returned 1 [0180.642] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xadf, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xadf, lpOverlapped=0x0) returned 1 [0180.644] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.674] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.691] CloseHandle (hObject=0x1f0) returned 1 [0180.691] CloseHandle (hObject=0x1f4) returned 1 [0180.694] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.z49-css-qhb")) returned 0 [0180.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.z49-css-qhb")) returned 0x20 [0180.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc0a322, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dc0a322, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfdda1820, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml", cAlternateFileName="8CE3D3~1.XML")) returned 0x7e2b48 [0180.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0180.697] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0180.910] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa6d, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa6d, lpOverlapped=0x0) returned 1 [0180.912] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa6d, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa6d, lpOverlapped=0x0) returned 1 [0180.913] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.953] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.965] CloseHandle (hObject=0x1f4) returned 1 [0180.977] CloseHandle (hObject=0x1f0) returned 1 [0180.981] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.z49-css-qhb")) returned 0 [0180.982] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml.z49-css-qhb")) returned 0x20 [0180.982] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8d56e57b-8663-136d-ff69-a004e217825a.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db254f9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7db254f9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfeec46de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa6d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="8d56e57b-8663-136d-ff69-a004e217825a.xml", cAlternateFileName="8D56E5~1.XML")) returned 0x7e2508 [0181.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0181.009] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0181.107] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa67, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa67, lpOverlapped=0x0) returned 1 [0181.109] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa67, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa67, lpOverlapped=0x0) returned 1 [0181.111] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.156] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.284] CloseHandle (hObject=0x1f0) returned 1 [0181.285] CloseHandle (hObject=0x1f4) returned 1 [0181.287] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.z49-css-qhb")) returned 0 [0181.288] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.z49-css-qhb")) returned 0x20 [0181.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9cdfc2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d9cdfc2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfff0277e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa67, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml", cAlternateFileName="8E383E~1.XML")) returned 0x7e2608 [0181.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0181.291] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0181.452] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc81, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc81, lpOverlapped=0x0) returned 1 [0181.455] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc81, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc81, lpOverlapped=0x0) returned 1 [0181.457] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.563] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.578] CloseHandle (hObject=0x1f4) returned 1 [0181.578] CloseHandle (hObject=0x1f0) returned 1 [0181.587] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.z49-css-qhb")) returned 0 [0181.588] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml.z49-css-qhb")) returned 0x20 [0181.588] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\91edce6b-d93b-f186-c4e2-d38502cc520e.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9f5f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x66a9f5f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x66a9f5f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc81, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="91edce6b-d93b-f186-c4e2-d38502cc520e.xml", cAlternateFileName="91EDCE~1.XML")) returned 0x7e2a88 [0181.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0181.593] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0181.709] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xcc9, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xcc9, lpOverlapped=0x0) returned 1 [0181.730] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xcc9, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xcc9, lpOverlapped=0x0) returned 1 [0181.732] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.777] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.792] CloseHandle (hObject=0x1f0) returned 1 [0181.792] CloseHandle (hObject=0x1f4) returned 1 [0181.795] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.z49-css-qhb")) returned 0 [0181.796] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml.z49-css-qhb")) returned 0x20 [0181.797] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\92c2558b-5247-7fec-0ec0-79f2583ab410.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb24dd5d, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xdb24dd5d, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xdb24dd5d, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0xcc9, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="92c2558b-5247-7fec-0ec0-79f2583ab410.xml", cAlternateFileName="92C255~1.XML")) returned 0x7e2508 [0181.800] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0181.800] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0181.955] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb0f, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xb0f, lpOverlapped=0x0) returned 1 [0181.997] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb0f, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xb0f, lpOverlapped=0x0) returned 1 [0181.998] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.028] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.061] CloseHandle (hObject=0x1f4) returned 1 [0182.061] CloseHandle (hObject=0x1f0) returned 1 [0182.062] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.z49-css-qhb")) returned 0 [0182.063] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.z49-css-qhb")) returned 0x20 [0182.064] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da406e3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7da406e3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x1071af7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml", cAlternateFileName="9D3AD2~1.XML")) returned 0x7e2608 [0182.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0182.066] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0182.200] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xcc8, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xcc8, lpOverlapped=0x0) returned 1 [0182.269] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xcc8, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xcc8, lpOverlapped=0x0) returned 1 [0182.271] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.301] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.369] CloseHandle (hObject=0x1f0) returned 1 [0182.370] CloseHandle (hObject=0x1f4) returned 1 [0182.371] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.z49-css-qhb")) returned 0 [0182.372] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml.z49-css-qhb")) returned 0x20 [0182.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1bac04c-582b-d37d-069c-13f17a799e18.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104b893, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x104b893, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x104b893, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xcc8, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="a1bac04c-582b-d37d-069c-13f17a799e18.xml", cAlternateFileName="A1BAC0~1.XML")) returned 0x7e2888 [0182.374] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0182.375] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0182.775] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xac2, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xac2, lpOverlapped=0x0) returned 1 [0182.920] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xac2, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xac2, lpOverlapped=0x0) returned 1 [0182.922] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.953] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.004] CloseHandle (hObject=0x1f4) returned 1 [0183.004] CloseHandle (hObject=0x1f0) returned 1 [0183.005] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.z49-css-qhb")) returned 0 [0183.006] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.z49-css-qhb")) returned 0x20 [0183.006] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db97c1a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7db97c1a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x23f6f61, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xac2, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml", cAlternateFileName="A1E5B1~1.XML")) returned 0x7e2888 [0183.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0183.009] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0183.118] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xcae, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xcae, lpOverlapped=0x0) returned 1 [0183.170] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xcae, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xcae, lpOverlapped=0x0) returned 1 [0183.172] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.201] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.254] CloseHandle (hObject=0x1f0) returned 1 [0183.255] CloseHandle (hObject=0x1f4) returned 1 [0183.259] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.z49-css-qhb")) returned 0 [0183.260] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.z49-css-qhb")) returned 0x20 [0183.260] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e4055d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7e4055d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7e4055d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml", cAlternateFileName="A7E08B~1.XML")) returned 0x7e2ac8 [0183.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0183.263] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0183.566] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc71, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc71, lpOverlapped=0x0) returned 1 [0183.578] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc71, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc71, lpOverlapped=0x0) returned 1 [0183.580] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.607] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.632] CloseHandle (hObject=0x1f4) returned 1 [0183.633] CloseHandle (hObject=0x1f0) returned 1 [0183.635] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.z49-css-qhb")) returned 0 [0183.636] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.z49-css-qhb")) returned 0x20 [0183.636] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf284473b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf284473b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf284473b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml", cAlternateFileName="AA4E72~1.XML")) returned 0x7e2708 [0183.638] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0183.639] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0183.798] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa6c, lpOverlapped=0x0) returned 1 [0183.800] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa6c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa6c, lpOverlapped=0x0) returned 1 [0183.801] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.828] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.875] CloseHandle (hObject=0x1f0) returned 1 [0183.875] CloseHandle (hObject=0x1f4) returned 1 [0183.879] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.z49-css-qhb")) returned 0 [0183.880] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml.z49-css-qhb")) returned 0x20 [0183.880] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ac116a72-b6b1-d558-23f6-10796e634d41.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e272861, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e272861, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x355740d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="ac116a72-b6b1-d558-23f6-10796e634d41.xml", cAlternateFileName="AC116A~1.XML")) returned 0x7e2bc8 [0183.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0183.883] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0184.000] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa3b, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa3b, lpOverlapped=0x0) returned 1 [0184.037] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa3b, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa3b, lpOverlapped=0x0) returned 1 [0184.039] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.070] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.100] CloseHandle (hObject=0x1f4) returned 1 [0184.100] CloseHandle (hObject=0x1f0) returned 1 [0184.107] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.z49-css-qhb")) returned 0 [0184.108] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.z49-css-qhb")) returned 0x20 [0184.108] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e37d943, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e37d943, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x456f261, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa3b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml", cAlternateFileName="B34B19~1.XML")) returned 0x7e2908 [0184.111] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0184.111] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0184.302] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xac2, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xac2, lpOverlapped=0x0) returned 1 [0184.315] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xac2, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xac2, lpOverlapped=0x0) returned 1 [0184.317] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.362] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.409] CloseHandle (hObject=0x1f0) returned 1 [0184.409] CloseHandle (hObject=0x1f4) returned 1 [0184.411] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.z49-css-qhb")) returned 0 [0184.412] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.z49-css-qhb")) returned 0x20 [0184.412] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de4668d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7de4668d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x56b836c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xac2, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml", cAlternateFileName="B81D7E~1.XML")) returned 0x7e2a88 [0184.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0184.414] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0184.585] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa51, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa51, lpOverlapped=0x0) returned 1 [0184.588] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa51, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa51, lpOverlapped=0x0) returned 1 [0184.589] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.619] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.634] CloseHandle (hObject=0x1f4) returned 1 [0184.634] CloseHandle (hObject=0x1f0) returned 1 [0184.639] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.z49-css-qhb")) returned 0 [0184.640] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml.z49-css-qhb")) returned 0x20 [0184.640] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\babc0ea4-dabb-04f7-1017-a11af9b29344.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9f5f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x66a9f5f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x66a9f5f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa51, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="babc0ea4-dabb-04f7-1017-a11af9b29344.xml", cAlternateFileName="BABC0E~1.XML")) returned 0x7e2688 [0184.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0184.643] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0184.730] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdd2, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xdd2, lpOverlapped=0x0) returned 1 [0184.732] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdd2, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xdd2, lpOverlapped=0x0) returned 1 [0184.733] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.759] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.773] CloseHandle (hObject=0x1f0) returned 1 [0184.774] CloseHandle (hObject=0x1f4) returned 1 [0184.779] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.z49-css-qhb")) returned 0 [0184.780] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.z49-css-qhb")) returned 0x20 [0184.780] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca2d62, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbca2d62, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbca2d62, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xdd2, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml", cAlternateFileName="BBC7A1~1.XML")) returned 0x7e2708 [0184.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0184.783] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0184.921] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa41, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa41, lpOverlapped=0x0) returned 1 [0184.940] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa41, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa41, lpOverlapped=0x0) returned 1 [0184.941] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.010] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.025] CloseHandle (hObject=0x1f4) returned 1 [0185.025] CloseHandle (hObject=0x1f0) returned 1 [0185.027] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.z49-css-qhb")) returned 0 [0185.027] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.z49-css-qhb")) returned 0x20 [0185.027] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd6185e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dd6185e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x78b1c3c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa41, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml", cAlternateFileName="BBFBE8~1.XML")) returned 0x7e2908 [0185.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0185.029] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0185.145] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa62, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa62, lpOverlapped=0x0) returned 1 [0185.147] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa62, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa62, lpOverlapped=0x0) returned 1 [0185.149] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.184] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.199] CloseHandle (hObject=0x1f0) returned 1 [0185.200] CloseHandle (hObject=0x1f4) returned 1 [0185.203] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.z49-css-qhb")) returned 0 [0185.203] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.z49-css-qhb")) returned 0x20 [0185.204] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dfea066, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dfea066, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x893c171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml", cAlternateFileName="BCDA97~1.XML")) returned 0x7e2c08 [0185.208] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0185.208] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0185.299] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1aa7, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x1aa7, lpOverlapped=0x0) returned 1 [0185.307] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1aa7, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x1aa7, lpOverlapped=0x0) returned 1 [0185.310] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.347] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.360] CloseHandle (hObject=0x1f4) returned 1 [0185.361] CloseHandle (hObject=0x1f0) returned 1 [0185.362] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.z49-css-qhb")) returned 0 [0185.363] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml.z49-css-qhb")) returned 0x20 [0185.363] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb373f2, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xfb373f2, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xfb373f2, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x1aa7, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml", cAlternateFileName="BE7366~1.XML")) returned 0x7e2608 [0185.365] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0185.366] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0185.484] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa6b, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa6b, lpOverlapped=0x0) returned 1 [0185.540] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa6b, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa6b, lpOverlapped=0x0) returned 1 [0185.541] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.571] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.584] CloseHandle (hObject=0x1f0) returned 1 [0185.631] CloseHandle (hObject=0x1f4) returned 1 [0185.635] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.z49-css-qhb")) returned 0 [0185.636] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.z49-css-qhb")) returned 0x20 [0185.636] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e488974, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e488974, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xac8af30, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa6b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml", cAlternateFileName="C3D42A~1.XML")) returned 0x7e2c88 [0185.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0185.642] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0185.713] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc91, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc91, lpOverlapped=0x0) returned 1 [0185.766] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc91, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc91, lpOverlapped=0x0) returned 1 [0185.768] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.792] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.809] CloseHandle (hObject=0x1f4) returned 1 [0185.809] CloseHandle (hObject=0x1f0) returned 1 [0185.811] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.z49-css-qhb")) returned 0 [0185.811] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.z49-css-qhb")) returned 0x20 [0185.811] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893c171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x893c171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x893c171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc91, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="c94a6c18-d496-da1c-8a02-fc6976e0145e.xml", cAlternateFileName="C94A6C~1.XML")) returned 0x7e2888 [0185.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0185.814] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0185.894] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc9d, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc9d, lpOverlapped=0x0) returned 1 [0185.914] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc9d, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc9d, lpOverlapped=0x0) returned 1 [0185.915] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.941] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.954] CloseHandle (hObject=0x1f0) returned 1 [0185.954] CloseHandle (hObject=0x1f4) returned 1 [0185.965] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.z49-css-qhb")) returned 0 [0185.966] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.z49-css-qhb")) returned 0x20 [0185.966] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ca947da2-7e9a-7249-8095-bceb379c6f74.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x355740d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x355740d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x355740d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="ca947da2-7e9a-7249-8095-bceb379c6f74.xml", cAlternateFileName="CA947D~1.XML")) returned 0x7e2c48 [0185.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0185.968] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0186.108] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc9d, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc9d, lpOverlapped=0x0) returned 1 [0186.111] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc9d, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc9d, lpOverlapped=0x0) returned 1 [0186.112] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.144] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.162] CloseHandle (hObject=0x1f4) returned 1 [0186.163] CloseHandle (hObject=0x1f0) returned 1 [0186.171] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.z49-css-qhb")) returned 0 [0186.172] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.z49-css-qhb")) returned 0x20 [0186.172] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfee9e48b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfee9e48b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfee9e48b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="cb692946-a9f3-639d-1064-a6d75a01b9c3.xml", cAlternateFileName="CB6929~1.XML")) returned 0x7e2c08 [0186.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0186.175] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0186.284] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc6b, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc6b, lpOverlapped=0x0) returned 1 [0186.375] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc6b, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc6b, lpOverlapped=0x0) returned 1 [0186.376] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.422] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.441] CloseHandle (hObject=0x1f0) returned 1 [0186.441] CloseHandle (hObject=0x1f4) returned 1 [0186.451] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.z49-css-qhb")) returned 0 [0186.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.z49-css-qhb")) returned 0x20 [0186.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb770a25, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeb770a25, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeb770a25, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc6b, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml", cAlternateFileName="D1ECFC~1.XML")) returned 0x7e2c08 [0186.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0186.456] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0186.618] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc7c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0186.658] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc7c, lpOverlapped=0x0) returned 1 [0186.659] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.690] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.709] CloseHandle (hObject=0x1f4) returned 1 [0186.710] CloseHandle (hObject=0x1f0) returned 1 [0186.711] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.z49-css-qhb")) returned 0 [0186.712] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml.z49-css-qhb")) returned 0x20 [0186.712] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d445d1cd-ecdf-2830-df9e-3f187e431898.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2c70d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xde2c70d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xde2c70d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="d445d1cd-ecdf-2830-df9e-3f187e431898.xml", cAlternateFileName="D445D1~1.XML")) returned 0x7e2c48 [0186.714] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0186.715] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0186.804] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xace, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xace, lpOverlapped=0x0) returned 1 [0186.930] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xace, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xace, lpOverlapped=0x0) returned 1 [0186.932] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.963] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.010] CloseHandle (hObject=0x1f0) returned 1 [0187.010] CloseHandle (hObject=0x1f4) returned 1 [0187.011] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.z49-css-qhb")) returned 0 [0187.012] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml.z49-css-qhb")) returned 0x20 [0187.012] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\d508ba05-d8aa-2836-484d-3833d22fe185.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc7ca36, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dc7ca36, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbcc9055, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xace, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="d508ba05-d8aa-2836-484d-3833d22fe185.xml", cAlternateFileName="D508BA~1.XML")) returned 0x7e2a88 [0187.014] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0187.015] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0187.103] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc77, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc77, lpOverlapped=0x0) returned 1 [0187.397] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc77, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc77, lpOverlapped=0x0) returned 1 [0187.398] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.595] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.619] CloseHandle (hObject=0x1f4) returned 1 [0187.620] CloseHandle (hObject=0x1f0) returned 1 [0187.621] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.z49-css-qhb")) returned 0 [0187.621] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml.z49-css-qhb")) returned 0x20 [0187.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\dc5bc54e-ee99-04c5-63a5-669bf0666354.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0125c0b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0125c0b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0125c0b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="dc5bc54e-ee99-04c5-63a5-669bf0666354.xml", cAlternateFileName="DC5BC5~1.XML")) returned 0x7e2688 [0187.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0187.623] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0187.691] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa52, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa52, lpOverlapped=0x0) returned 1 [0187.919] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa52, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa52, lpOverlapped=0x0) returned 1 [0187.921] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.954] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.988] CloseHandle (hObject=0x1f0) returned 1 [0187.988] CloseHandle (hObject=0x1f4) returned 1 [0187.989] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.z49-css-qhb")) returned 0 [0187.990] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.z49-css-qhb")) returned 0x20 [0187.990] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e05c76e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e05c76e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcdee677, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml", cAlternateFileName="E2A686~1.XML")) returned 0x7e2608 [0187.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0187.992] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0188.074] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc76, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0188.235] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc76, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc76, lpOverlapped=0x0) returned 1 [0188.237] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.260] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.271] CloseHandle (hObject=0x1f4) returned 1 [0188.271] CloseHandle (hObject=0x1f0) returned 1 [0188.274] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.z49-css-qhb")) returned 0 [0188.274] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.z49-css-qhb")) returned 0x20 [0188.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8eb3d8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xda8eb3d8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe69651bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml", cAlternateFileName="E335BA~1.XML")) returned 0x7e2b08 [0188.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0188.277] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0188.347] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xad4, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xad4, lpOverlapped=0x0) returned 1 [0188.349] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xad4, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xad4, lpOverlapped=0x0) returned 1 [0188.361] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.397] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.408] CloseHandle (hObject=0x1f0) returned 1 [0188.408] CloseHandle (hObject=0x1f4) returned 1 [0188.410] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.z49-css-qhb")) returned 0 [0188.410] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml.z49-css-qhb")) returned 0x20 [0188.410] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e603fcd0-9cde-3f41-875c-5cc396d927ce.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde52960, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xde52960, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xde52960, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e603fcd0-9cde-3f41-875c-5cc396d927ce.xml", cAlternateFileName="E603FC~1.XML")) returned 0x7e2b88 [0188.413] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0188.413] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0188.486] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa51, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa51, lpOverlapped=0x0) returned 1 [0188.596] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa51, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa51, lpOverlapped=0x0) returned 1 [0188.597] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.625] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.700] CloseHandle (hObject=0x1f4) returned 1 [0188.700] CloseHandle (hObject=0x1f0) returned 1 [0188.702] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.z49-css-qhb")) returned 0 [0188.703] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml.z49-css-qhb")) returned 0x20 [0188.703] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e64ffef1-e246-b632-595b-56076a3fa776.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e30b1b9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e30b1b9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xed5f72a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa51, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e64ffef1-e246-b632-595b-56076a3fa776.xml", cAlternateFileName="E64FFE~1.XML")) returned 0x7e2a88 [0188.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0188.706] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0188.876] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xaea, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xaea, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xaea, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xaea, lpOverlapped=0x0) returned 1 [0188.915] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.940] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.099] CloseHandle (hObject=0x1f0) returned 1 [0189.100] CloseHandle (hObject=0x1f4) returned 1 [0189.101] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.z49-css-qhb")) returned 0 [0189.102] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.z49-css-qhb")) returned 0x20 [0189.102] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d95b8ca, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d95b8ca, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfda4de9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xaea, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml", cAlternateFileName="E8AC93~1.XML")) returned 0x7e2888 [0189.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0189.105] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0189.221] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa5c, lpOverlapped=0x0) returned 1 [0189.246] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa5c, lpOverlapped=0x0) returned 1 [0189.247] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.276] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.351] CloseHandle (hObject=0x1f4) returned 1 [0189.352] CloseHandle (hObject=0x1f0) returned 1 [0189.354] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.z49-css-qhb")) returned 0 [0189.355] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.z49-css-qhb")) returned 0x20 [0189.355] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\e8fff2df-6041-8f21-3df7-db31661aa09b.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3efff1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e3efff1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x10ec523b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="e8fff2df-6041-8f21-3df7-db31661aa09b.xml", cAlternateFileName="E8FFF2~1.XML")) returned 0x7e2a88 [0189.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0189.358] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0189.662] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc71, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc71, lpOverlapped=0x0) returned 1 [0189.664] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc71, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc71, lpOverlapped=0x0) returned 1 [0189.665] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.749] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.761] CloseHandle (hObject=0x1f0) returned 1 [0189.761] CloseHandle (hObject=0x1f4) returned 1 [0189.762] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.z49-css-qhb")) returned 0 [0189.763] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.z49-css-qhb")) returned 0x20 [0189.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78192ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x78192ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x78192ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml", cAlternateFileName="ECBC26~1.XML")) returned 0x7e2bc8 [0189.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0189.765] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0190.042] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa46, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa46, lpOverlapped=0x0) returned 1 [0190.071] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa46, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa46, lpOverlapped=0x0) returned 1 [0190.072] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.098] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.110] CloseHandle (hObject=0x1f4) returned 1 [0190.111] CloseHandle (hObject=0x1f0) returned 1 [0190.115] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.z49-css-qhb")) returned 0 [0190.153] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.z49-css-qhb")) returned 0x20 [0190.153] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\eee47229-947d-2ac7-e8a3-49bafee251d1.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5939ec, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e5939ec, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x11f4f803, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="eee47229-947d-2ac7-e8a3-49bafee251d1.xml", cAlternateFileName="EEE472~1.XML")) returned 0x7e2a88 [0190.155] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0190.156] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0190.292] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc92, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xc92, lpOverlapped=0x0) returned 1 [0190.342] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc92, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xc92, lpOverlapped=0x0) returned 1 [0190.344] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.372] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.435] CloseHandle (hObject=0x1f0) returned 1 [0190.436] CloseHandle (hObject=0x1f4) returned 1 [0190.437] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.z49-css-qhb")) returned 0 [0190.438] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml.z49-css-qhb")) returned 0x20 [0190.438] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e92946, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe4e92946, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe4e92946, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc92, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml", cAlternateFileName="F428C4~1.XML")) returned 0x7e2b88 [0190.440] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0190.441] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0190.593] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa4c, lpOverlapped=0x0) returned 1 [0190.748] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa4c, lpOverlapped=0x0) returned 1 [0190.749] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.786] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.819] CloseHandle (hObject=0x1f4) returned 1 [0190.819] CloseHandle (hObject=0x1f0) returned 1 [0190.828] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.z49-css-qhb")) returned 0 [0190.829] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\archive\\apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.z49-css-qhb")) returned 0x20 [0190.829] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b7edb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7b7edb, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x1304c3c7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="fc93b452-8a84-dede-3b7a-0fc9413c4592.xml", cAlternateFileName="FC93B4~1.XML")) returned 0x7e2888 [0190.834] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0190.835] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0191.024] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdc870, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xdc870, lpOverlapped=0x0) returned 1 [0191.105] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdc870, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xdc870, lpOverlapped=0x0) returned 1 [0191.125] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.299] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.318] CloseHandle (hObject=0x1e8) returned 1 [0191.318] CloseHandle (hObject=0x1ec) returned 1 [0191.337] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat.z49-css-qhb")) returned 0 [0191.338] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat.z49-css-qhb")) returned 0x20 [0191.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b51a174, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfbdffacb, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xdc870, dwReserved0=0x0, dwReserved1=0x4c, cFileName="tokens.dat", cAlternateFileName="")) returned 0x7e2888 [0191.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0191.414] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0191.658] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0xafc58, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xafc58, lpOverlapped=0x0) returned 1 [0191.677] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xafc58, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xafc58, lpOverlapped=0x0) returned 1 [0191.753] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.831] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.847] CloseHandle (hObject=0x1ec) returned 1 [0191.847] CloseHandle (hObject=0x1e8) returned 1 [0191.917] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.z49-css-qhb")) returned 0 [0191.918] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.z49-css-qhb")) returned 0x20 [0191.918] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6acf85b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xccc1dbbe, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xccc1dbbe, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0xafc58, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="dmrc.idx", cAlternateFileName="")) returned 0x7e2548 [0191.929] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat.z49-css-qhb")) returned 1 [0191.932] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat.z49-css-qhb")) returned 0x20 [0191.932] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80!\x07\x02Ì#\x07\x02(2@")) returned 0xffffffff [0191.944] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0191.945] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0192.215] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3c8e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3c8e, lpOverlapped=0x0) returned 1 [0192.218] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3c8e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3c8e, lpOverlapped=0x0) returned 1 [0192.220] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.378] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.391] CloseHandle (hObject=0x1e8) returned 1 [0192.391] CloseHandle (hObject=0x1ec) returned 1 [0192.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml.z49-css-qhb")) returned 0 [0192.393] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-09-26.xml.z49-css-qhb")) returned 0x20 [0192.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-09-26.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14fcc049, ftCreationTime.dwHighDateTime=0x1d336da, ftLastAccessTime.dwLowDateTime=0x14fcc049, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x14fa5e38, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x3c8e, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="energy-report-2017-09-26.xml", cAlternateFileName="ENERGY~2.XML")) returned 0x7e2608 [0192.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0192.396] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0192.739] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3c8e, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3c8e, lpOverlapped=0x0) returned 1 [0192.965] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3c8e, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3c8e, lpOverlapped=0x0) returned 1 [0192.982] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.009] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.020] CloseHandle (hObject=0x1ec) returned 1 [0193.021] CloseHandle (hObject=0x1e8) returned 1 [0193.107] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml.z49-css-qhb")) returned 0 [0193.108] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml.z49-css-qhb")) returned 0x20 [0193.108] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f337c3, ftCreationTime.dwHighDateTime=0x1d336da, ftLastAccessTime.dwLowDateTime=0x14f337c3, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x14fa5e38, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x3c8e, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 0x7e2c08 [0193.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0193.112] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0193.239] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3641, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3641, lpOverlapped=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3641, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3641, lpOverlapped=0x0) returned 1 [0193.287] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.360] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.419] CloseHandle (hObject=0x1e8) returned 1 [0193.420] CloseHandle (hObject=0x1ec) returned 1 [0193.421] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.z49-css-qhb")) returned 0 [0193.421] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.z49-css-qhb")) returned 0x20 [0193.422] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1516f86b, ftCreationTime.dwHighDateTime=0x1d336da, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x1516f86b, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 0x7e2b88 [0193.425] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0193.425] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0193.682] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6229, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x6229, lpOverlapped=0x0) returned 1 [0193.703] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6229, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x6229, lpOverlapped=0x0) returned 1 [0193.705] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.736] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.798] CloseHandle (hObject=0x1ec) returned 1 [0193.799] CloseHandle (hObject=0x1e8) returned 1 [0193.803] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml.z49-css-qhb")) returned 0 [0193.804] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\sleepstudy\\sleepstudy-report-latest.xml.z49-css-qhb")) returned 0x20 [0193.804] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\SleepStudy\\sleepstudy-report-latest.xml", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb42f5b, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x6229, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="sleepstudy-report-latest.xml", cAlternateFileName="SLEEPS~1.XML")) returned 0x7e2608 [0193.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0193.838] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0193.996] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0xae, lpOverlapped=0x0) returned 1 [0193.997] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0xae, lpOverlapped=0x0) returned 1 [0193.998] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.089] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.105] CloseHandle (hObject=0x1e8) returned 1 [0194.106] CloseHandle (hObject=0x1ec) returned 1 [0194.150] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.z49-css-qhb")) returned 0 [0194.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.z49-css-qhb")) returned 0x20 [0194.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f43b93, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2688 [0194.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0194.206] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0194.538] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x974, lpOverlapped=0x0) returned 1 [0194.540] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x974, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x974, lpOverlapped=0x0) returned 1 [0194.542] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.705] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.720] CloseHandle (hObject=0x1e8) returned 1 [0194.721] CloseHandle (hObject=0x1f0) returned 1 [0194.723] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.z49-css-qhb")) returned 0 [0194.724] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.z49-css-qhb")) returned 0x20 [0194.724] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ae4bfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ae4bfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ae4bfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 0x7e2a88 [0195.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0195.020] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0195.469] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x172, lpOverlapped=0x0) returned 1 [0195.471] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x172, lpOverlapped=0x0) returned 1 [0195.472] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.640] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.652] CloseHandle (hObject=0x1e8) returned 1 [0195.653] CloseHandle (hObject=0x1f4) returned 1 [0195.930] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.z49-css-qhb")) returned 0 [0196.013] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.z49-css-qhb")) returned 0x20 [0196.014] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e2bc8 [0196.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0196.093] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0196.193] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4dc, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x4dc, lpOverlapped=0x0) returned 1 [0196.195] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4dc, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x4dc, lpOverlapped=0x0) returned 1 [0196.196] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.227] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.238] CloseHandle (hObject=0x1f4) returned 1 [0196.239] CloseHandle (hObject=0x1e8) returned 1 [0196.244] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.z49-css-qhb")) returned 0 [0196.246] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.z49-css-qhb")) returned 0x20 [0196.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 0x7e2848 [0196.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0196.260] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0196.437] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x5c4, lpOverlapped=0x0) returned 1 [0196.438] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x5c4, lpOverlapped=0x0) returned 1 [0196.440] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.463] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.478] CloseHandle (hObject=0x1e8) returned 1 [0196.478] CloseHandle (hObject=0x1f4) returned 1 [0196.488] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.z49-css-qhb")) returned 0 [0196.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.z49-css-qhb")) returned 0x20 [0196.491] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2708 [0196.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0196.498] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0196.588] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x49e, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x49e, lpOverlapped=0x0) returned 1 [0196.590] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x49e, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x49e, lpOverlapped=0x0) returned 1 [0196.591] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.704] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.719] CloseHandle (hObject=0x1f4) returned 1 [0196.719] CloseHandle (hObject=0x1e8) returned 1 [0196.726] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.z49-css-qhb")) returned 0 [0196.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.z49-css-qhb")) returned 0x20 [0196.731] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98a4376e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98a4376e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Math Input Panel.lnk", cAlternateFileName="")) returned 0x7e2a88 [0196.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0196.739] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0196.855] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x45a, lpOverlapped=0x0) returned 1 [0196.861] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x45a, lpOverlapped=0x0) returned 1 [0196.863] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.896] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.913] CloseHandle (hObject=0x1e8) returned 1 [0196.913] CloseHandle (hObject=0x1f4) returned 1 [0196.918] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.z49-css-qhb")) returned 0 [0196.921] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.z49-css-qhb")) returned 0x20 [0196.921] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630c736a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x630c736a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x630c736a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Paint.lnk", cAlternateFileName="")) returned 0x7e2a88 [0196.925] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0196.925] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0197.122] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x48c, lpOverlapped=0x0) returned 1 [0197.160] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x48c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x48c, lpOverlapped=0x0) returned 1 [0197.161] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.201] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.213] CloseHandle (hObject=0x1f4) returned 1 [0197.213] CloseHandle (hObject=0x1e8) returned 1 [0197.222] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.z49-css-qhb")) returned 0 [0197.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.z49-css-qhb")) returned 0x20 [0197.225] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6e8df9, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9e26238d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x9c706000, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="Quick Assist.lnk", cAlternateFileName="")) returned 0x7e2ac8 [0197.279] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0197.279] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0197.351] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x4bf, lpOverlapped=0x0) returned 1 [0197.353] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4bf, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x4bf, lpOverlapped=0x0) returned 1 [0197.354] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.390] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.403] CloseHandle (hObject=0x1e8) returned 1 [0197.403] CloseHandle (hObject=0x1f4) returned 1 [0197.417] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.z49-css-qhb")) returned 0 [0197.421] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.z49-css-qhb")) returned 0x20 [0197.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c555e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x67c555e4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x67c555e4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="")) returned 0x7e2c88 [0197.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0197.428] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0197.497] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x46e, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x46e, lpOverlapped=0x0) returned 1 [0197.499] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x46e, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x46e, lpOverlapped=0x0) returned 1 [0197.500] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.524] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.536] CloseHandle (hObject=0x1f4) returned 1 [0197.537] CloseHandle (hObject=0x1e8) returned 1 [0197.540] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.z49-css-qhb")) returned 0 [0197.571] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.z49-css-qhb")) returned 0x20 [0197.571] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8ce781, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8ce781, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="Snipping Tool.lnk", cAlternateFileName="")) returned 0x7e2b88 [0197.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0197.578] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0197.703] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x448, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x448, lpOverlapped=0x0) returned 1 [0197.782] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x448, lpOverlapped=0x0) returned 1 [0197.783] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.807] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.819] CloseHandle (hObject=0x1e8) returned 1 [0197.819] CloseHandle (hObject=0x1f4) returned 1 [0197.820] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.z49-css-qhb")) returned 0 [0197.821] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.z49-css-qhb")) returned 0x20 [0197.821] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378897b7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x378897b7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x378897b7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="Steps Recorder.lnk", cAlternateFileName="")) returned 0x7e2888 [0197.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0197.825] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0198.028] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x45a, lpOverlapped=0x0) returned 1 [0198.112] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x45a, lpOverlapped=0x0) returned 1 [0198.113] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.136] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.148] CloseHandle (hObject=0x1e8) returned 1 [0198.148] CloseHandle (hObject=0x1fc) returned 1 [0198.150] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.z49-css-qhb")) returned 0 [0198.150] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.z49-css-qhb")) returned 0x20 [0198.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655bc768, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x655bc768, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x655bc768, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Character Map.lnk", cAlternateFileName="")) returned 0x7e2848 [0198.274] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0198.274] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0198.370] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x55, lpOverlapped=0x0) returned 1 [0198.371] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x55, lpOverlapped=0x0) returned 1 [0198.374] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.403] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.433] CloseHandle (hObject=0x1fc) returned 1 [0198.433] CloseHandle (hObject=0x1e8) returned 1 [0198.457] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.z49-css-qhb")) returned 0 [0198.460] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.z49-css-qhb")) returned 0x20 [0198.461] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2a88 [0198.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0198.514] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0198.657] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x448, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x448, lpOverlapped=0x0) returned 1 [0198.704] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x448, lpOverlapped=0x0) returned 1 [0198.706] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.730] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.743] CloseHandle (hObject=0x1f4) returned 1 [0198.743] CloseHandle (hObject=0x1e8) returned 1 [0198.744] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.z49-css-qhb")) returned 0 [0198.745] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.z49-css-qhb")) returned 0x20 [0198.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="")) returned 0x7e2688 [0198.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0198.754] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0198.828] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x543, lpOverlapped=0x0) returned 1 [0198.831] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x543, lpOverlapped=0x0) returned 1 [0198.833] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.866] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.884] CloseHandle (hObject=0x1e8) returned 1 [0198.884] CloseHandle (hObject=0x1f4) returned 1 [0198.896] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.z49-css-qhb")) returned 0 [0198.902] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.z49-css-qhb")) returned 0x20 [0198.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xf78d700, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Windows Media Player.lnk", cAlternateFileName="")) returned 0x7e2c08 [0198.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0198.906] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0199.002] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x482, lpOverlapped=0x0) returned 1 [0199.093] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x482, lpOverlapped=0x0) returned 1 [0199.095] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.132] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.190] CloseHandle (hObject=0x1f4) returned 1 [0199.190] CloseHandle (hObject=0x1e8) returned 1 [0199.197] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.z49-css-qhb")) returned 0 [0199.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.z49-css-qhb")) returned 0x20 [0199.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653f2a91, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x653f2a91, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x653f2a91, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0x7e2848 [0199.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0199.294] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0199.379] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x462, lpOverlapped=0x0) returned 1 [0199.381] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x462, lpOverlapped=0x0) returned 1 [0199.382] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.473] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.492] CloseHandle (hObject=0x1e8) returned 1 [0199.492] CloseHandle (hObject=0x1f4) returned 1 [0199.498] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.z49-css-qhb")) returned 0 [0199.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.z49-css-qhb")) returned 0x20 [0199.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96ce7e01, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="XPS Viewer.lnk", cAlternateFileName="")) returned 0x7e2ac8 [0199.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0199.508] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0199.583] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x999, lpOverlapped=0x0) returned 1 [0199.585] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x999, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x999, lpOverlapped=0x0) returned 1 [0199.586] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.670] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.685] CloseHandle (hObject=0x1f0) returned 1 [0199.686] CloseHandle (hObject=0x1f4) returned 1 [0199.693] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.z49-css-qhb")) returned 0 [0199.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.z49-css-qhb")) returned 0x20 [0199.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 0x7e2688 [0199.704] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0199.704] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0199.820] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x45c, lpOverlapped=0x0) returned 1 [0199.870] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x45c, lpOverlapped=0x0) returned 1 [0199.871] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.902] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.918] CloseHandle (hObject=0x1f0) returned 1 [0199.918] CloseHandle (hObject=0x1e8) returned 1 [0199.922] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.z49-css-qhb")) returned 0 [0199.927] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.z49-css-qhb")) returned 0x20 [0199.928] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1db61d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c1db61d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c1db61d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Component Services.lnk", cAlternateFileName="")) returned 0x7e2848 [0199.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0199.939] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0200.067] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x48c, lpOverlapped=0x0) returned 1 [0200.085] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x48c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x48c, lpOverlapped=0x0) returned 1 [0200.088] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.126] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.142] CloseHandle (hObject=0x1e8) returned 1 [0200.143] CloseHandle (hObject=0x1f0) returned 1 [0200.160] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.z49-css-qhb")) returned 0 [0200.185] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.z49-css-qhb")) returned 0x20 [0200.185] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33042a24, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x33042a24, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x33042a24, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Computer Management.lnk", cAlternateFileName="")) returned 0x7e2c88 [0200.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0200.192] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0200.455] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa26, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa26, lpOverlapped=0x0) returned 1 [0200.456] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa26, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa26, lpOverlapped=0x0) returned 1 [0200.457] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.514] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.562] CloseHandle (hObject=0x1f0) returned 1 [0200.562] CloseHandle (hObject=0x1e8) returned 1 [0200.735] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.z49-css-qhb")) returned 0 [0200.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.z49-css-qhb")) returned 0x20 [0200.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2848 [0200.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0200.751] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0200.979] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x486, lpOverlapped=0x0) returned 1 [0200.982] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x486, lpOverlapped=0x0) returned 1 [0200.989] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.023] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.039] CloseHandle (hObject=0x1e8) returned 1 [0201.040] CloseHandle (hObject=0x1f0) returned 1 [0201.045] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.z49-css-qhb")) returned 0 [0201.046] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.z49-css-qhb")) returned 0x20 [0201.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399c4fa7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x399c4fa7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x399c4fa7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 0x7e26c8 [0201.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0201.049] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0201.162] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x45c, lpOverlapped=0x0) returned 1 [0201.236] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x45c, lpOverlapped=0x0) returned 1 [0201.238] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.283] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.300] CloseHandle (hObject=0x1f0) returned 1 [0201.300] CloseHandle (hObject=0x1e8) returned 1 [0201.309] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.z49-css-qhb")) returned 0 [0201.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.z49-css-qhb")) returned 0x20 [0201.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64367fd2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x64367fd2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x64367fd2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Disk Cleanup.lnk", cAlternateFileName="")) returned 0x7e26c8 [0201.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0201.325] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0201.490] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x490, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x490, lpOverlapped=0x0) returned 1 [0201.492] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x490, lpOverlapped=0x0) returned 1 [0201.493] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.525] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.541] CloseHandle (hObject=0x1e8) returned 1 [0201.541] CloseHandle (hObject=0x1f0) returned 1 [0201.551] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.z49-css-qhb")) returned 0 [0201.554] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.z49-css-qhb")) returned 0x20 [0201.555] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dc802b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dc802b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dc802b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Event Viewer.lnk", cAlternateFileName="")) returned 0x7e2c08 [0201.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0201.561] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0201.732] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x478, lpOverlapped=0x0) returned 1 [0201.735] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x478, lpOverlapped=0x0) returned 1 [0201.736] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.760] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.809] CloseHandle (hObject=0x1f0) returned 1 [0201.810] CloseHandle (hObject=0x1e8) returned 1 [0201.816] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.z49-css-qhb")) returned 0 [0201.818] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.z49-css-qhb")) returned 0x20 [0201.818] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="iSCSI Initiator.lnk", cAlternateFileName="")) returned 0x7e2c48 [0201.826] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0201.826] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0201.938] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x474, lpOverlapped=0x0) returned 1 [0201.990] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x474, lpOverlapped=0x0) returned 1 [0201.991] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.015] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.027] CloseHandle (hObject=0x1e8) returned 1 [0202.028] CloseHandle (hObject=0x1f0) returned 1 [0202.029] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.z49-css-qhb")) returned 0 [0202.040] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.z49-css-qhb")) returned 0x20 [0202.040] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39893c6e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x39893c6e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x39893c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="")) returned 0x7e2708 [0202.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0202.045] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0202.118] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x474, lpOverlapped=0x0) returned 1 [0202.131] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x474, lpOverlapped=0x0) returned 1 [0202.133] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.162] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.219] CloseHandle (hObject=0x1f0) returned 1 [0202.219] CloseHandle (hObject=0x1e8) returned 1 [0202.226] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.z49-css-qhb")) returned 0 [0202.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.z49-css-qhb")) returned 0x20 [0202.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2782ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2782ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2782ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="ODBC Data Sources (32-bit).lnk", cAlternateFileName="")) returned 0x7e2a88 [0202.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0202.239] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0202.341] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x474, lpOverlapped=0x0) returned 1 [0202.343] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x474, lpOverlapped=0x0) returned 1 [0202.344] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.375] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.386] CloseHandle (hObject=0x1e8) returned 1 [0202.387] CloseHandle (hObject=0x1f0) returned 1 [0202.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.z49-css-qhb")) returned 0 [0202.397] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.z49-css-qhb")) returned 0x20 [0202.398] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="ODBC Data Sources (64-bit).lnk", cAlternateFileName="")) returned 0x7e2888 [0202.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0202.484] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0202.560] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x450, lpOverlapped=0x0) returned 1 [0202.564] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x450, lpOverlapped=0x0) returned 1 [0202.565] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.589] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.603] CloseHandle (hObject=0x1f0) returned 1 [0202.603] CloseHandle (hObject=0x1e8) returned 1 [0202.610] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.z49-css-qhb")) returned 0 [0202.708] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.z49-css-qhb")) returned 0x20 [0202.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Performance Monitor.lnk", cAlternateFileName="")) returned 0x7e2c48 [0202.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0202.719] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0202.787] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x45e, lpOverlapped=0x0) returned 1 [0202.793] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45e, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x45e, lpOverlapped=0x0) returned 1 [0202.794] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.822] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.837] CloseHandle (hObject=0x1e8) returned 1 [0202.838] CloseHandle (hObject=0x1f0) returned 1 [0202.877] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.z49-css-qhb")) returned 0 [0202.879] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.z49-css-qhb")) returned 0x20 [0202.879] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8822b6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8822b6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8822b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Print Management.lnk", cAlternateFileName="")) returned 0x7e2a88 [0202.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0202.884] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0203.053] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x454, lpOverlapped=0x0) returned 1 [0203.057] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x454, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x454, lpOverlapped=0x0) returned 1 [0203.059] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.116] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.132] CloseHandle (hObject=0x1f0) returned 1 [0203.133] CloseHandle (hObject=0x1e8) returned 1 [0203.137] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.z49-css-qhb")) returned 0 [0203.185] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.z49-css-qhb")) returned 0x20 [0203.185] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Resource Monitor.lnk", cAlternateFileName="")) returned 0x7e2bc8 [0203.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0203.298] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0203.388] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x462, lpOverlapped=0x0) returned 1 [0203.654] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x462, lpOverlapped=0x0) returned 1 [0203.657] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.779] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.800] CloseHandle (hObject=0x1e8) returned 1 [0203.800] CloseHandle (hObject=0x1f0) returned 1 [0203.820] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.z49-css-qhb")) returned 0 [0203.842] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.z49-css-qhb")) returned 0x20 [0203.842] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c66c10d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c66c10d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c66c10d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x88, cFileName="Security Configuration Management.lnk", cAlternateFileName="")) returned 0x7e2b88 [0203.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0203.849] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0204.004] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x486, lpOverlapped=0x0) returned 1 [0204.016] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x486, lpOverlapped=0x0) returned 1 [0204.018] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.155] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.202] CloseHandle (hObject=0x1f0) returned 1 [0204.202] CloseHandle (hObject=0x1e8) returned 1 [0204.219] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.z49-css-qhb")) returned 0 [0204.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.z49-css-qhb")) returned 0x20 [0204.223] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f116ee, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x32f116ee, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x32f116ee, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="services.lnk", cAlternateFileName="")) returned 0x7e2a88 [0204.225] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0204.225] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0204.313] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x45c, lpOverlapped=0x0) returned 1 [0204.378] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x45c, lpOverlapped=0x0) returned 1 [0204.380] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.409] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.438] CloseHandle (hObject=0x1e8) returned 1 [0204.439] CloseHandle (hObject=0x1f0) returned 1 [0204.448] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.z49-css-qhb")) returned 0 [0204.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.z49-css-qhb")) returned 0x20 [0204.453] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b498035, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b498035, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b498035, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="System Configuration.lnk", cAlternateFileName="")) returned 0x7e2848 [0204.458] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0204.458] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0204.547] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x45a, lpOverlapped=0x0) returned 1 [0204.549] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x45a, lpOverlapped=0x0) returned 1 [0204.551] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.585] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.600] CloseHandle (hObject=0x1f0) returned 1 [0204.600] CloseHandle (hObject=0x1e8) returned 1 [0204.612] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.z49-css-qhb")) returned 0 [0204.669] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.z49-css-qhb")) returned 0x20 [0204.669] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34d51ec6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34d51ec6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34d51ec6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="System Information.lnk", cAlternateFileName="")) returned 0x7e2bc8 [0204.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0204.682] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0204.841] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x46c, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x46c, lpOverlapped=0x0) returned 1 [0204.900] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x46c, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x46c, lpOverlapped=0x0) returned 1 [0204.902] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.934] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.952] CloseHandle (hObject=0x1e8) returned 1 [0204.952] CloseHandle (hObject=0x1f0) returned 1 [0204.956] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.z49-css-qhb")) returned 0 [0204.962] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.z49-css-qhb")) returned 0x20 [0204.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dee28b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dee28b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dee28b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Task Scheduler.lnk", cAlternateFileName="")) returned 0x7e2b88 [0205.015] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0205.016] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0205.113] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x484, lpOverlapped=0x0) returned 1 [0205.116] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x484, lpOverlapped=0x0) returned 1 [0205.117] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.150] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.165] CloseHandle (hObject=0x1f0) returned 1 [0205.165] CloseHandle (hObject=0x1e8) returned 1 [0205.169] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.z49-css-qhb")) returned 0 [0205.181] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.z49-css-qhb")) returned 0x20 [0205.181] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4e2f6c78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="")) returned 0x7e2b88 [0205.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0205.190] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0205.274] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x31c, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x31c, lpOverlapped=0x0) returned 1 [0205.275] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x31c, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x31c, lpOverlapped=0x0) returned 1 [0205.276] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.308] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.324] CloseHandle (hObject=0x1f4) returned 1 [0205.324] CloseHandle (hObject=0x1e8) returned 1 [0205.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.z49-css-qhb")) returned 0 [0205.397] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.z49-css-qhb")) returned 0x20 [0205.398] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x5c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2848 [0205.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0205.416] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0205.573] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x973, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x973, lpOverlapped=0x0) returned 1 [0205.581] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x973, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x973, lpOverlapped=0x0) returned 1 [0205.582] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.615] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.632] CloseHandle (hObject=0x1e8) returned 1 [0205.632] CloseHandle (hObject=0x1f4) returned 1 [0205.635] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.z49-css-qhb")) returned 0 [0205.639] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.z49-css-qhb")) returned 0x20 [0205.639] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b0ade7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4b0ade7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x5c, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 0x7e2848 [0205.646] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0205.647] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0205.795] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x926, lpOverlapped=0x0) returned 1 [0205.797] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x926, lpOverlapped=0x0) returned 1 [0205.799] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.830] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.845] CloseHandle (hObject=0x1f4) returned 1 [0205.846] CloseHandle (hObject=0x1e8) returned 1 [0205.851] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.z49-css-qhb")) returned 0 [0205.854] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.z49-css-qhb")) returned 0x20 [0205.854] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x7e2a88 [0205.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0205.861] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0206.184] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x92d, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x92d, lpOverlapped=0x0) returned 1 [0206.186] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x92d, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x92d, lpOverlapped=0x0) returned 1 [0206.188] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.326] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.360] CloseHandle (hObject=0x1e8) returned 1 [0206.361] CloseHandle (hObject=0x1f4) returned 1 [0206.465] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.z49-css-qhb")) returned 0 [0206.658] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.z49-css-qhb")) returned 0x20 [0206.658] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x97a9db13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97a9db13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97a9db13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x92d, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="Immersive Control Panel.lnk", cAlternateFileName="")) returned 0x7e2a88 [0206.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0206.672] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0206.753] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x830, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x830, lpOverlapped=0x0) returned 1 [0206.760] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x830, lpOverlapped=0x0) returned 1 [0206.764] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.794] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.807] CloseHandle (hObject=0x1e8) returned 1 [0206.808] CloseHandle (hObject=0x1f0) returned 1 [0206.817] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.z49-css-qhb")) returned 0 [0206.821] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.z49-css-qhb")) returned 0x20 [0206.821] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x830, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 0x7e2a88 [0206.833] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0206.834] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0206.978] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x842, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x842, lpOverlapped=0x0) returned 1 [0207.003] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x842, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x842, lpOverlapped=0x0) returned 1 [0207.005] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.037] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.055] CloseHandle (hObject=0x1f0) returned 1 [0207.055] CloseHandle (hObject=0x1e8) returned 1 [0207.060] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.z49-css-qhb")) returned 0 [0207.064] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.z49-css-qhb")) returned 0x20 [0207.064] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x842, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 0x7e2a88 [0207.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0207.077] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0207.196] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x818, lpOverlapped=0x0) returned 1 [0207.198] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x818, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x818, lpOverlapped=0x0) returned 1 [0207.199] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.231] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.243] CloseHandle (hObject=0x1e8) returned 1 [0207.243] CloseHandle (hObject=0x1f0) returned 1 [0207.266] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.z49-css-qhb")) returned 0 [0207.269] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.z49-css-qhb")) returned 0x20 [0207.270] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac326e8c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac326e8c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 0x7e2888 [0207.275] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0207.275] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0207.358] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xb4, lpOverlapped=0x0) returned 1 [0207.360] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xb4, lpOverlapped=0x0) returned 1 [0207.362] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.393] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.405] CloseHandle (hObject=0x1f0) returned 1 [0207.406] CloseHandle (hObject=0x1e8) returned 1 [0207.409] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.url.z49-css-qhb")) returned 0 [0207.413] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.url.z49-css-qhb")) returned 0x20 [0207.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cf99e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac1cf99e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac1cf99e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Get Help.url", cAlternateFileName="GETHEL~1.URL")) returned 0x7e2a88 [0207.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0207.444] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0207.799] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xb0, lpOverlapped=0x0) returned 1 [0207.801] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xb0, lpOverlapped=0x0) returned 1 [0207.803] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.857] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.872] CloseHandle (hObject=0x1e8) returned 1 [0207.873] CloseHandle (hObject=0x1f0) returned 1 [0207.900] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url.z49-css-qhb")) returned 0 [0207.904] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url.z49-css-qhb")) returned 0x20 [0207.904] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac15d256, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Visit Java.com.url", cAlternateFileName="VISITJ~1.URL")) returned 0x7e2c08 [0207.943] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0207.944] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0208.060] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xaa, lpOverlapped=0x0) returned 1 [0208.061] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xaa, lpOverlapped=0x0) returned 1 [0208.067] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.103] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.148] CloseHandle (hObject=0x1f0) returned 1 [0208.148] CloseHandle (hObject=0x1e8) returned 1 [0208.160] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.z49-css-qhb")) returned 0 [0208.163] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.z49-css-qhb")) returned 0x20 [0208.163] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e2c48 [0208.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0208.173] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0208.268] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa03, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa03, lpOverlapped=0x0) returned 1 [0208.270] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa03, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa03, lpOverlapped=0x0) returned 1 [0208.272] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.302] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.313] CloseHandle (hObject=0x1e8) returned 1 [0208.314] CloseHandle (hObject=0x1f0) returned 1 [0208.320] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.z49-css-qhb")) returned 0 [0208.324] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.z49-css-qhb")) returned 0x20 [0208.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0x7d8578, dwReserved1=0x7f2120, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 0x7e2c48 [0208.331] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0208.331] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0208.413] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x988, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x988, lpOverlapped=0x0) returned 1 [0208.433] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x988, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x988, lpOverlapped=0x0) returned 1 [0208.434] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.498] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.514] CloseHandle (hObject=0x1f0) returned 1 [0208.514] CloseHandle (hObject=0x1e8) returned 1 [0208.521] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.z49-css-qhb")) returned 0 [0208.526] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.z49-css-qhb")) returned 0x20 [0208.526] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c88562, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c88562, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c88562, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 0x7e2b88 [0208.542] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0208.543] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0208.651] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa15, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa15, lpOverlapped=0x0) returned 1 [0209.071] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa15, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa15, lpOverlapped=0x0) returned 1 [0209.073] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.097] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.113] CloseHandle (hObject=0x1e8) returned 1 [0209.114] CloseHandle (hObject=0x1f0) returned 1 [0209.118] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.z49-css-qhb")) returned 0 [0209.121] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.z49-css-qhb")) returned 0x20 [0209.121] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cfac8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cfac8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cfac8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa15, dwReserved0=0x0, dwReserved1=0x88, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 0x7e2ac8 [0209.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0209.130] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0209.280] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8eb, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x8eb, lpOverlapped=0x0) returned 1 [0209.285] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8eb, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x8eb, lpOverlapped=0x0) returned 1 [0209.287] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.321] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.336] CloseHandle (hObject=0x1f0) returned 1 [0209.337] CloseHandle (hObject=0x1e8) returned 1 [0209.348] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.z49-css-qhb")) returned 0 [0209.352] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.z49-css-qhb")) returned 0x20 [0209.352] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x8eb, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Project Server 2016 Accounts.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 0x7e2a88 [0209.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0209.368] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0209.473] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x9a1, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x9a1, lpOverlapped=0x0) returned 1 [0209.484] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x9a1, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x9a1, lpOverlapped=0x0) returned 1 [0209.485] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.519] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.559] CloseHandle (hObject=0x1e8) returned 1 [0209.560] CloseHandle (hObject=0x1f0) returned 1 [0209.595] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.z49-css-qhb")) returned 0 [0209.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.z49-css-qhb")) returned 0x20 [0209.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 0x7e2c48 [0209.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0209.610] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0209.711] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa0f, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa0f, lpOverlapped=0x0) returned 1 [0209.757] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa0f, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa0f, lpOverlapped=0x0) returned 1 [0209.759] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.844] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.861] CloseHandle (hObject=0x1f0) returned 1 [0209.862] CloseHandle (hObject=0x1e8) returned 1 [0209.881] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.z49-css-qhb")) returned 0 [0209.887] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.z49-css-qhb")) returned 0x20 [0209.887] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x88, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 0x7e2b88 [0209.911] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0209.911] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0210.195] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x9d4, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x9d4, lpOverlapped=0x0) returned 1 [0210.232] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x9d4, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x9d4, lpOverlapped=0x0) returned 1 [0210.233] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.265] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.282] CloseHandle (hObject=0x1e8) returned 1 [0210.283] CloseHandle (hObject=0x1f0) returned 1 [0210.289] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.z49-css-qhb")) returned 0 [0210.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.z49-css-qhb")) returned 0x20 [0210.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9d4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 0x7e2848 [0210.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0210.362] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0210.466] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa16, lpOverlapped=0x0) returned 1 [0210.530] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa16, lpOverlapped=0x0) returned 1 [0210.531] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.563] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.579] CloseHandle (hObject=0x1f0) returned 1 [0210.580] CloseHandle (hObject=0x1e8) returned 1 [0210.602] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.z49-css-qhb")) returned 0 [0210.605] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.z49-css-qhb")) returned 0x20 [0210.605] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0x7e2a88 [0210.629] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0210.630] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0210.722] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8ab, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x8ab, lpOverlapped=0x0) returned 1 [0210.747] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8ab, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x8ab, lpOverlapped=0x0) returned 1 [0210.750] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.785] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.801] CloseHandle (hObject=0x1f4) returned 1 [0210.801] CloseHandle (hObject=0x1e8) returned 1 [0210.809] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.z49-css-qhb")) returned 0 [0210.811] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.z49-css-qhb")) returned 0x20 [0210.811] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 0x7e2908 [0210.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0210.817] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0210.955] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x3f3, lpOverlapped=0x0) returned 1 [0210.957] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x3f3, lpOverlapped=0x0) returned 1 [0210.959] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.985] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.996] CloseHandle (hObject=0x1e8) returned 1 [0210.997] CloseHandle (hObject=0x1f4) returned 1 [0211.004] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.z49-css-qhb")) returned 0 [0211.006] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.z49-css-qhb")) returned 0x20 [0211.007] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef80377f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0x7e2bc8 [0211.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0211.017] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0211.139] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x9c2, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x9c2, lpOverlapped=0x0) returned 1 [0211.259] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x9c2, lpOverlapped=0x0) returned 1 [0211.260] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.397] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.412] CloseHandle (hObject=0x1f4) returned 1 [0211.413] CloseHandle (hObject=0x1e8) returned 1 [0211.422] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.z49-css-qhb")) returned 0 [0211.424] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.z49-css-qhb")) returned 0x20 [0211.424] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 0x7e2848 [0211.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0211.445] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0211.538] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x95f, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x95f, lpOverlapped=0x0) returned 1 [0211.541] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x95f, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x95f, lpOverlapped=0x0) returned 1 [0211.543] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.574] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.591] CloseHandle (hObject=0x1e8) returned 1 [0211.591] CloseHandle (hObject=0x1f4) returned 1 [0211.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.z49-css-qhb")) returned 0 [0211.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.z49-css-qhb")) returned 0x20 [0211.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 0x7e2688 [0211.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0211.618] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0211.705] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x96d, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x96d, lpOverlapped=0x0) returned 1 [0211.707] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x96d, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x96d, lpOverlapped=0x0) returned 1 [0211.709] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.738] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.754] CloseHandle (hObject=0x1f4) returned 1 [0211.755] CloseHandle (hObject=0x1e8) returned 1 [0211.766] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.z49-css-qhb")) returned 0 [0211.769] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.z49-css-qhb")) returned 0x20 [0211.769] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x96d, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 0x7e2688 [0211.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0211.782] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0211.877] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x998, lpOverlapped=0x0) returned 1 [0211.879] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x998, lpOverlapped=0x0) returned 1 [0211.882] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.950] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.977] CloseHandle (hObject=0x1e8) returned 1 [0211.978] CloseHandle (hObject=0x1f4) returned 1 [0211.992] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.z49-css-qhb")) returned 0 [0211.994] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.z49-css-qhb")) returned 0x20 [0211.994] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 0x7e2548 [0212.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0212.012] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0212.139] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x897, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x897, lpOverlapped=0x0) returned 1 [0212.142] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x897, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x897, lpOverlapped=0x0) returned 1 [0212.144] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.170] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.183] CloseHandle (hObject=0x1f4) returned 1 [0212.183] CloseHandle (hObject=0x1e8) returned 1 [0212.192] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.z49-css-qhb")) returned 0 [0212.195] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.z49-css-qhb")) returned 0x20 [0212.195] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x567be970, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x567be970, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x567be970, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x897, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="PrintDialog.lnk", cAlternateFileName="")) returned 0x7e2508 [0212.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0212.201] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0212.283] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x87e, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x87e, lpOverlapped=0x0) returned 1 [0212.285] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x87e, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x87e, lpOverlapped=0x0) returned 1 [0212.286] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.317] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.394] CloseHandle (hObject=0x1e8) returned 1 [0212.395] CloseHandle (hObject=0x1f4) returned 1 [0212.407] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.z49-css-qhb")) returned 0 [0212.409] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.z49-css-qhb")) returned 0x20 [0212.412] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x87e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Project 2016.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 0x7e2848 [0212.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0212.423] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0212.572] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x967, lpOverlapped=0x0) returned 1 [0212.585] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x967, lpOverlapped=0x0) returned 1 [0212.587] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.625] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.640] CloseHandle (hObject=0x1f4) returned 1 [0212.640] CloseHandle (hObject=0x1e8) returned 1 [0212.647] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.z49-css-qhb")) returned 0 [0212.649] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.z49-css-qhb")) returned 0x20 [0212.650] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 0x7e2848 [0212.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0212.660] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0212.762] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x99e, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x99e, lpOverlapped=0x0) returned 1 [0212.764] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x99e, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x99e, lpOverlapped=0x0) returned 1 [0212.766] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.804] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.821] CloseHandle (hObject=0x1e8) returned 1 [0212.822] CloseHandle (hObject=0x1f4) returned 1 [0212.831] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.z49-css-qhb")) returned 0 [0212.834] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.z49-css-qhb")) returned 0x20 [0212.834] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 0x7e2ac8 [0212.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0212.850] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0212.967] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xae, lpOverlapped=0x0) returned 1 [0212.970] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xae, lpOverlapped=0x0) returned 1 [0212.973] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.040] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.057] CloseHandle (hObject=0x1e8) returned 1 [0213.057] CloseHandle (hObject=0x1f0) returned 1 [0213.067] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.z49-css-qhb")) returned 0 [0213.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.z49-css-qhb")) returned 0x20 [0213.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2848 [0213.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0213.115] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0213.250] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x152, lpOverlapped=0x0) returned 1 [0213.252] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x152, lpOverlapped=0x0) returned 1 [0213.254] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.285] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.299] CloseHandle (hObject=0x1f0) returned 1 [0213.300] CloseHandle (hObject=0x1e8) returned 1 [0213.305] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.z49-css-qhb")) returned 0 [0213.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.z49-css-qhb")) returned 0x20 [0213.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e2c48 [0213.316] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0213.317] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0213.472] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x460, lpOverlapped=0x0) returned 1 [0213.476] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x460, lpOverlapped=0x0) returned 1 [0213.478] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.546] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.565] CloseHandle (hObject=0x1e8) returned 1 [0213.565] CloseHandle (hObject=0x1f0) returned 1 [0213.573] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.z49-css-qhb")) returned 0 [0213.577] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.z49-css-qhb")) returned 0x20 [0213.577] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c6d05b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34c6d05b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34c6d05b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="Task Manager.lnk", cAlternateFileName="")) returned 0x7e2888 [0213.587] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0213.587] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0213.673] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x422, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x422, lpOverlapped=0x0) returned 1 [0213.702] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x422, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x422, lpOverlapped=0x0) returned 1 [0213.704] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.729] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.743] CloseHandle (hObject=0x1f0) returned 1 [0213.743] CloseHandle (hObject=0x1e8) returned 1 [0213.752] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.z49-css-qhb")) returned 0 [0213.755] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.z49-css-qhb")) returned 0x20 [0213.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Windows Defender.lnk", cAlternateFileName="")) returned 0x7e2b48 [0213.770] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0213.770] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0213.853] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x86e, lpOverlapped=0x0) returned 1 [0213.863] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x86e, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x86e, lpOverlapped=0x0) returned 1 [0213.864] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.892] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.909] CloseHandle (hObject=0x1f4) returned 1 [0213.909] CloseHandle (hObject=0x1e8) returned 1 [0213.916] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.z49-css-qhb")) returned 0 [0213.919] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.z49-css-qhb")) returned 0x20 [0213.919] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x5c, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 0x7e2848 [0213.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0213.938] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0214.111] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2e1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x2e1, lpOverlapped=0x0) returned 1 [0214.147] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2e1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x2e1, lpOverlapped=0x0) returned 1 [0214.150] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.181] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.197] CloseHandle (hObject=0x1e8) returned 1 [0214.198] CloseHandle (hObject=0x1f4) returned 1 [0214.204] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.z49-css-qhb")) returned 0 [0214.208] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.z49-css-qhb")) returned 0x20 [0214.209] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea725d67, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea725d67, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea725d67, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Windows 10 Update Assistant.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x7e2b88 [0214.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0214.223] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0214.293] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x628, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x628, lpOverlapped=0x0) returned 1 [0214.416] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x628, lpOverlapped=0x0) returned 1 [0214.417] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.462] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.476] CloseHandle (hObject=0x1f4) returned 1 [0214.477] CloseHandle (hObject=0x1e8) returned 1 [0214.487] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.z49-css-qhb")) returned 0 [0214.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.z49-css-qhb")) returned 0x20 [0214.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e664927, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e664927, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e664927, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x7e2c48 [0214.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0214.523] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0214.638] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x999, lpOverlapped=0x0) returned 1 [0214.641] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x999, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x999, lpOverlapped=0x0) returned 1 [0214.643] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.674] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.690] CloseHandle (hObject=0x1e8) returned 1 [0214.690] CloseHandle (hObject=0x1f4) returned 1 [0214.697] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.z49-css-qhb")) returned 0 [0214.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.z49-css-qhb")) returned 0x20 [0214.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x5c, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0x7e2848 [0214.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0214.712] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0214.801] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x493, lpOverlapped=0x0) returned 1 [0214.803] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x493, lpOverlapped=0x0) returned 1 [0214.805] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.838] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.853] CloseHandle (hObject=0x1ec) returned 1 [0214.854] CloseHandle (hObject=0x1f4) returned 1 [0214.858] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.z49-css-qhb")) returned 0 [0214.859] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.z49-css-qhb")) returned 0x20 [0214.859] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="01 - File Explorer.lnk", cAlternateFileName="")) returned 0x7e2688 [0214.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0214.865] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0215.121] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x151, lpOverlapped=0x0) returned 1 [0215.122] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x151, lpOverlapped=0x0) returned 1 [0215.124] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.158] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.171] CloseHandle (hObject=0x1f4) returned 1 [0215.172] CloseHandle (hObject=0x1ec) returned 1 [0215.177] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk.z49-css-qhb")) returned 0 [0215.178] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk.z49-css-qhb")) returned 0x20 [0215.178] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="03 - Documents.lnk", cAlternateFileName="")) returned 0x7e2ac8 [0215.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0215.185] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0215.278] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x151, lpOverlapped=0x0) returned 1 [0215.281] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x151, lpOverlapped=0x0) returned 1 [0215.283] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.314] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.330] CloseHandle (hObject=0x1ec) returned 1 [0215.330] CloseHandle (hObject=0x1f4) returned 1 [0215.337] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk.z49-css-qhb")) returned 0 [0215.338] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk.z49-css-qhb")) returned 0x20 [0215.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="04 - Downloads.lnk", cAlternateFileName="")) returned 0x7e2a88 [0215.353] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0215.354] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0215.549] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x149, lpOverlapped=0x0) returned 1 [0215.551] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x149, lpOverlapped=0x0) returned 1 [0215.553] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.583] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.598] CloseHandle (hObject=0x1f4) returned 1 [0215.611] CloseHandle (hObject=0x1ec) returned 1 [0215.617] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk.z49-css-qhb")) returned 0 [0215.618] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk.z49-css-qhb")) returned 0x20 [0215.618] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x5c, cFileName="05 - Music.lnk", cAlternateFileName="")) returned 0x7e2688 [0215.624] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0215.624] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0215.707] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x151, lpOverlapped=0x0) returned 1 [0215.709] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x151, lpOverlapped=0x0) returned 1 [0215.710] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.736] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.750] CloseHandle (hObject=0x1ec) returned 1 [0215.750] CloseHandle (hObject=0x1f4) returned 1 [0215.756] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk.z49-css-qhb")) returned 0 [0215.757] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk.z49-css-qhb")) returned 0x20 [0215.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="06 - Pictures.lnk", cAlternateFileName="")) returned 0x7e2708 [0215.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0215.763] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0215.846] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x14d, lpOverlapped=0x0) returned 1 [0215.847] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x14d, lpOverlapped=0x0) returned 1 [0215.849] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.878] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.895] CloseHandle (hObject=0x1f4) returned 1 [0215.895] CloseHandle (hObject=0x1ec) returned 1 [0215.900] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk.z49-css-qhb")) returned 0 [0215.901] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk.z49-css-qhb")) returned 0x20 [0215.901] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x5c, cFileName="07 - Videos.lnk", cAlternateFileName="")) returned 0x7e2b88 [0215.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0215.908] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0216.050] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x117, lpOverlapped=0x0) returned 1 [0216.051] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x117, lpOverlapped=0x0) returned 1 [0216.053] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.085] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.100] CloseHandle (hObject=0x1ec) returned 1 [0216.100] CloseHandle (hObject=0x1f4) returned 1 [0216.104] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.z49-css-qhb")) returned 0 [0216.105] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.z49-css-qhb")) returned 0x20 [0216.106] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="08 - Homegroup.lnk", cAlternateFileName="")) returned 0x7e2688 [0216.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0216.115] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0216.282] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x113, lpOverlapped=0x0) returned 1 [0216.284] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x113, lpOverlapped=0x0) returned 1 [0216.285] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.312] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.330] CloseHandle (hObject=0x1f4) returned 1 [0216.331] CloseHandle (hObject=0x1ec) returned 1 [0216.335] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk.z49-css-qhb")) returned 0 [0216.336] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk.z49-css-qhb")) returned 0x20 [0216.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x5c, cFileName="09 - Network.lnk", cAlternateFileName="")) returned 0x7e2a48 [0216.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0216.342] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0216.497] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x141, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x141, lpOverlapped=0x0) returned 1 [0216.498] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x141, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x141, lpOverlapped=0x0) returned 1 [0216.499] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.531] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.546] CloseHandle (hObject=0x1ec) returned 1 [0216.547] CloseHandle (hObject=0x1f4) returned 1 [0216.552] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.z49-css-qhb")) returned 0 [0216.553] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.z49-css-qhb")) returned 0x20 [0216.553] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="10 - UserProfile.lnk", cAlternateFileName="")) returned 0x7e2908 [0216.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0216.560] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0216.677] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x240, lpOverlapped=0x0) returned 1 [0216.679] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x240, lpOverlapped=0x0) returned 1 [0216.680] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.725] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.751] CloseHandle (hObject=0x1f4) returned 1 [0216.751] CloseHandle (hObject=0x1ec) returned 1 [0216.771] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini.z49-css-qhb")) returned 0 [0216.772] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini.z49-css-qhb")) returned 0x20 [0216.772] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2b48 [0216.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0216.829] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0216.922] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x11d0d0, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x11d0d0, lpOverlapped=0x0) returned 1 [0217.026] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x11d0d0, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x11d0d0, lpOverlapped=0x0) returned 1 [0217.059] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.092] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.108] CloseHandle (hObject=0x1f4) returned 1 [0217.108] CloseHandle (hObject=0x1e8) returned 1 [0217.140] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll.z49-css-qhb")) returned 0 [0217.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll.z49-css-qhb")) returned 0x20 [0217.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11d0d0, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="GapaEngine.dll", cAlternateFileName="")) returned 0x7e2508 [0217.146] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0217.147] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0217.293] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0217.611] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0217.769] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0217.918] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0218.090] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x211740, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x211740, lpOverlapped=0x0) returned 1 [0218.154] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x211740, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x211740, lpOverlapped=0x0) returned 1 [0218.217] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.248] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.272] CloseHandle (hObject=0x1e8) returned 1 [0218.273] CloseHandle (hObject=0x1f4) returned 1 [0218.739] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll.z49-css-qhb")) returned 0 [0218.740] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll.z49-css-qhb")) returned 0x20 [0218.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c4b1e3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc11740, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MpEngine.dll", cAlternateFileName="")) returned 0x7e2888 [0218.740] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c4b1e3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc11740, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="MpEngine.dll", cAlternateFileName="")) returned 0 [0218.740] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0218.741] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll")) returned 0 [0218.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll")) returned 0x20 [0218.741] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e318, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="NisBase.vdm", cAlternateFileName="")) returned 1 [0218.742] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="NisFull.vdm", cAlternateFileName="")) returned 1 [0218.742] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="NisFull.vdm", cAlternateFileName="")) returned 0 [0218.742] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0218.742] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0218.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0218.743] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0218.743] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0218.743] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0218.743] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="Updates", cAlternateFileName="")) returned 1 [0218.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0218.743] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0218.743] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0218.743] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0218.744] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="Updates", cAlternateFileName="")) returned 0 [0218.744] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0218.744] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x6c747075, cFileName="Features", cAlternateFileName="")) returned 1 [0218.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0218.745] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="..", cAlternateFileName="")) returned 1 [0218.745] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="..", cAlternateFileName="")) returned 0 [0218.745] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0218.745] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x6c747075, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0218.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0218.746] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="..", cAlternateFileName="")) returned 1 [0218.746] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="..", cAlternateFileName="")) returned 0 [0218.746] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0218.746] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x6c747075, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0218.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0218.747] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="..", cAlternateFileName="")) returned 1 [0218.747] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="Support", cAlternateFileName="")) returned 1 [0218.747] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0218.747] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0218.748] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fbd4a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="NisLog.txt", cAlternateFileName="")) returned 1 [0218.748] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0218.749] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0218.750] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161 [0218.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0218.751] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0218.844] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x161, lpOverlapped=0x0) returned 1 [0218.846] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x161, lpOverlapped=0x0) returned 1 [0218.848] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.880] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.894] CloseHandle (hObject=0x1f4) returned 1 [0218.895] CloseHandle (hObject=0x1e8) returned 1 [0218.896] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.z49-css-qhb")) returned 0 [0218.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.z49-css-qhb")) returned 0x20 [0218.897] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fbd4a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53132827, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="NisLog.txt", cAlternateFileName="")) returned 0x7e2b88 [0218.898] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fbd4a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x53132827, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="NisLog.txt", cAlternateFileName="")) returned 0 [0218.898] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0218.898] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 1 [0218.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 0xffffffff [0218.900] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fbd4a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="NisLog.txt", cAlternateFileName="")) returned 0 [0218.900] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0218.915] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c7546, dwReserved1=0x6d64762e, cFileName="Support", cAlternateFileName="")) returned 0 [0218.915] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0218.916] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726f70, dwReserved1=0x6c747075, cFileName="Platform", cAlternateFileName="")) returned 1 [0218.916] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0218.916] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="..", cAlternateFileName="")) returned 1 [0218.916] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="..", cAlternateFileName="")) returned 0 [0218.916] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0218.917] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726f70, dwReserved1=0x6c747075, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0218.917] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0218.917] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="..", cAlternateFileName="")) returned 1 [0218.917] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="..", cAlternateFileName="")) returned 0 [0218.917] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0218.917] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726f70, dwReserved1=0x6c747075, cFileName="Scans", cAlternateFileName="")) returned 1 [0218.918] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0218.921] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="..", cAlternateFileName="")) returned 1 [0218.922] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="CleanFileTelemetry", cAlternateFileName="CLEANF~1")) returned 1 [0218.922] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0218.922] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0218.922] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0218.922] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0218.923] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2703fb5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac58c824, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e676f4c, dwReserved1=0x6d747874, cFileName="CleanStore", cAlternateFileName="CLEANS~1")) returned 1 [0218.923] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2703fb5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac58c824, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0218.925] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2703fb5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac58c824, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0218.925] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Entries", cAlternateFileName="")) returned 1 [0218.925] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0218.926] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0218.926] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0218.926] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0218.926] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="ResourceData", cAlternateFileName="RESOUR~1")) returned 1 [0218.926] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0218.927] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0218.927] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0218.927] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0218.928] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Resources", cAlternateFileName="RESOUR~2")) returned 1 [0218.928] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0218.928] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0218.928] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0218.928] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0218.928] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Resources", cAlternateFileName="RESOUR~2")) returned 0 [0218.929] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0218.929] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28a95cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3125c62, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6372756f, dwReserved1=0x74617365, cFileName="History", cAlternateFileName="")) returned 1 [0218.929] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28a95cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3125c62, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0218.931] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28a95cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3125c62, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0218.931] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1 [0218.931] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0218.932] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0218.932] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0218.932] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0218.932] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28aac86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2dde708, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Mput", cAlternateFileName="")) returned 1 [0218.932] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28aac86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2dde708, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0218.932] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28aac86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2dde708, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0218.932] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28ab6dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3040e3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="MputHistory", cAlternateFileName="MPUTHI~1")) returned 1 [0218.932] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28ab6dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3040e3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0218.934] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28ab6dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3040e3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.934] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2900a03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00", cAlternateFileName="")) returned 1 [0218.934] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2900a03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0218.935] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2900a03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.935] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="192", cAlternateFileName="")) returned 1 [0218.935] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0218.937] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0218.937] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0218.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0218.938] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0219.018] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.019] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.020] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.045] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.059] CloseHandle (hObject=0x1fc) returned 1 [0219.060] CloseHandle (hObject=0x200) returned 1 [0219.063] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.064] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.064] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="192", cAlternateFileName="")) returned 0x7e2a48 [0219.064] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="192", cAlternateFileName="")) returned 0 [0219.064] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0219.064] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 1 [0219.065] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.066] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.066] CloseHandle (hObject=0xffffffff) returned 1 [0219.066] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.066] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.066] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.066] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0219.066] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.066] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.067] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.067] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.067] CloseHandle (hObject=0xffffffff) returned 1 [0219.067] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.067] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.067] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.068] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0219.068] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.068] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.068] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.068] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.068] CloseHandle (hObject=0xffffffff) returned 1 [0219.068] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.069] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.069] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.069] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0219.069] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.069] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.069] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.069] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.070] CloseHandle (hObject=0xffffffff) returned 1 [0219.070] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.070] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.070] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.070] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02`$\x07\x02(2@")) returned 0 [0219.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.070] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.070] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.071] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.071] CloseHandle (hObject=0xffffffff) returned 1 [0219.071] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.071] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.071] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.071] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02`$\x07\x02(2@")) returned 0 [0219.071] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.072] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.072] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.072] CloseHandle (hObject=0xffffffff) returned 1 [0219.072] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.072] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.073] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02`$\x07\x02(2@")) returned 0 [0219.073] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.073] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.073] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.073] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.073] CloseHandle (hObject=0xffffffff) returned 1 [0219.073] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.073] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.073] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.074] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02`$\x07\x02(2@")) returned 0 [0219.074] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.074] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.074] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.074] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.074] CloseHandle (hObject=0xffffffff) returned 1 [0219.074] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.074] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.075] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.075] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02`$\x07\x02(2@")) returned 0 [0219.075] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.075] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.075] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.075] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.075] CloseHandle (hObject=0xffffffff) returned 1 [0219.075] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.076] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.076] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02`$\x07\x02(2@")) returned 0 [0219.076] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.076] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.076] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.076] CloseHandle (hObject=0xffffffff) returned 1 [0219.077] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.077] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02`$\x07\x02(2@")) returned 0 [0219.077] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.077] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.078] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.078] CloseHandle (hObject=0xffffffff) returned 1 [0219.078] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.078] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02`$\x07\x02(2@")) returned 0 [0219.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.078] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.079] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.079] CloseHandle (hObject=0xffffffff) returned 1 [0219.079] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.080] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02`$\x07\x02(2@")) returned 0 [0219.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.080] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.080] CloseHandle (hObject=0xffffffff) returned 1 [0219.080] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.081] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02`$\x07\x02(2@")) returned 0 [0219.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.081] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.081] CloseHandle (hObject=0xffffffff) returned 1 [0219.081] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.082] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.082] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02`$\x07\x02(2@")) returned 0 [0219.082] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.082] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.082] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.082] CloseHandle (hObject=0xffffffff) returned 1 [0219.082] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0 [0219.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192.z49-css-qhb")) returned 0x20 [0219.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0219.083] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02`$\x07\x02(2@")) returned 0 [0219.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.083] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00")) returned 0 [0219.084] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\192" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\00\\192")) returned 0xffffffff [0219.084] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="192", cAlternateFileName="")) returned 0 [0219.084] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0219.084] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc290171f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2e0495b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="01", cAlternateFileName="")) returned 1 [0219.084] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc290171f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2e0495b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0219.085] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc290171f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2e0495b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0219.085] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="271", cAlternateFileName="")) returned 1 [0219.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0219.088] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0219.088] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0219.088] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0219.089] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0219.164] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.166] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.167] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.198] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.212] CloseHandle (hObject=0x200) returned 1 [0219.212] CloseHandle (hObject=0x1fc) returned 1 [0219.213] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.214] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="271", cAlternateFileName="")) returned 0x7e2a48 [0219.215] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="271", cAlternateFileName="")) returned 0 [0219.215] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0219.215] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 1 [0219.216] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.216] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.216] CloseHandle (hObject=0xffffffff) returned 1 [0219.216] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.217] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.217] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`$\x07\x02D-\x07\x02(2@")) returned 0 [0219.217] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.217] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.218] CloseHandle (hObject=0xffffffff) returned 1 [0219.218] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.218] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.218] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.218] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`$\x07\x02D-\x07\x02(2@")) returned 0 [0219.218] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.218] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.218] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.219] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.219] CloseHandle (hObject=0xffffffff) returned 1 [0219.219] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.219] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.219] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.219] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`$\x07\x02D-\x07\x02(2@")) returned 0 [0219.219] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.219] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.220] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.220] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.220] CloseHandle (hObject=0xffffffff) returned 1 [0219.220] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.220] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.220] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.220] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0219.220] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.221] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.221] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.221] CloseHandle (hObject=0xffffffff) returned 1 [0219.221] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.221] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.222] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0219.222] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.222] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.222] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.222] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.222] CloseHandle (hObject=0xffffffff) returned 1 [0219.222] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.222] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.222] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.223] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0219.223] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.223] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.223] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.223] CloseHandle (hObject=0xffffffff) returned 1 [0219.223] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.223] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.224] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0219.224] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.224] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.224] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.224] CloseHandle (hObject=0xffffffff) returned 1 [0219.224] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.225] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.225] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.225] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0219.225] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.225] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.225] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.225] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.225] CloseHandle (hObject=0xffffffff) returned 1 [0219.225] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.226] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.226] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0219.226] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.226] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.226] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.227] CloseHandle (hObject=0xffffffff) returned 1 [0219.227] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.227] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.227] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0219.227] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.227] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.228] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.228] CloseHandle (hObject=0xffffffff) returned 1 [0219.228] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.228] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.228] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0219.228] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.228] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.229] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.229] CloseHandle (hObject=0xffffffff) returned 1 [0219.229] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.229] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.232] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0219.232] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.232] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.232] CloseHandle (hObject=0xffffffff) returned 1 [0219.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.233] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0219.233] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.233] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.234] CloseHandle (hObject=0xffffffff) returned 1 [0219.234] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.234] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0219.234] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.234] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.235] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.235] CloseHandle (hObject=0xffffffff) returned 1 [0219.235] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0 [0219.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271.z49-css-qhb")) returned 0x20 [0219.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.235] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0 [0219.235] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.235] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01")) returned 0 [0219.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\271" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\01\\271")) returned 0xffffffff [0219.236] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="271", cAlternateFileName="")) returned 0 [0219.236] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0219.236] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2951aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="02", cAlternateFileName="")) returned 1 [0219.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2951aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0219.258] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2951aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0219.258] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="109004", cAlternateFileName="")) returned 1 [0219.258] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0219.298] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0219.299] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0219.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0219.299] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0219.413] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.415] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.416] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.456] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.471] CloseHandle (hObject=0x1fc) returned 1 [0219.471] CloseHandle (hObject=0x200) returned 1 [0219.472] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.473] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.473] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109004", cAlternateFileName="")) returned 0x7e2b48 [0219.474] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109004", cAlternateFileName="")) returned 0 [0219.474] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0219.474] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 1 [0219.475] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.476] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.476] CloseHandle (hObject=0xffffffff) returned 1 [0219.476] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.476] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.476] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.477] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02d$\x07\x02(2@")) returned 0 [0219.477] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.477] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.477] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.477] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.477] CloseHandle (hObject=0xffffffff) returned 1 [0219.477] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.477] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.477] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.478] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02d$\x07\x02(2@")) returned 0 [0219.478] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.478] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.478] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.478] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.478] CloseHandle (hObject=0xffffffff) returned 1 [0219.478] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.479] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.479] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.479] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02d$\x07\x02(2@")) returned 0 [0219.479] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.479] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.479] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.479] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.479] CloseHandle (hObject=0xffffffff) returned 1 [0219.480] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.480] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.480] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="X-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.480] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="X-\x07\x02d$\x07\x02(2@")) returned 0 [0219.480] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.480] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.480] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.480] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.481] CloseHandle (hObject=0xffffffff) returned 1 [0219.481] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.481] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.481] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.481] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h-\x07\x02d$\x07\x02(2@")) returned 0 [0219.481] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.481] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.481] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.481] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.481] CloseHandle (hObject=0xffffffff) returned 1 [0219.481] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.482] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="x-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.482] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="x-\x07\x02d$\x07\x02(2@")) returned 0 [0219.482] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.482] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.482] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.482] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.482] CloseHandle (hObject=0xffffffff) returned 1 [0219.482] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.482] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.483] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88-\x07\x02d$\x07\x02(2@")) returned 0 [0219.483] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.483] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.483] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.483] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.483] CloseHandle (hObject=0xffffffff) returned 1 [0219.483] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.483] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.484] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98-\x07\x02d$\x07\x02(2@")) returned 0 [0219.484] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.484] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.484] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.484] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.484] CloseHandle (hObject=0xffffffff) returned 1 [0219.484] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.484] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.484] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.484] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02d$\x07\x02(2@")) returned 0 [0219.484] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.484] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.484] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.485] CloseHandle (hObject=0xffffffff) returned 1 [0219.485] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.485] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸-\x07\x02d$\x07\x02(2@")) returned 0 [0219.485] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.485] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.485] CloseHandle (hObject=0xffffffff) returned 1 [0219.485] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.486] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È-\x07\x02d$\x07\x02(2@")) returned 0 [0219.486] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.486] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.486] CloseHandle (hObject=0xffffffff) returned 1 [0219.486] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.487] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø-\x07\x02d$\x07\x02(2@")) returned 0 [0219.487] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.487] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.487] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.487] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.487] CloseHandle (hObject=0xffffffff) returned 1 [0219.487] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.487] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.487] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.487] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è-\x07\x02d$\x07\x02(2@")) returned 0 [0219.487] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.488] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.488] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.488] CloseHandle (hObject=0xffffffff) returned 1 [0219.488] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.488] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø-\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.488] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø-\x07\x02d$\x07\x02(2@")) returned 0 [0219.488] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.488] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.488] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.488] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.489] CloseHandle (hObject=0xffffffff) returned 1 [0219.489] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0 [0219.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004.z49-css-qhb")) returned 0x20 [0219.489] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08.\x07\x02d$\x07\x02(2@")) returned 0xffffffff [0219.489] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08.\x07\x02d$\x07\x02(2@")) returned 0 [0219.489] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.489] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02")) returned 0 [0219.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\109004" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\02\\109004")) returned 0xffffffff [0219.490] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="109004", cAlternateFileName="")) returned 0 [0219.490] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0219.490] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc295215e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x343030, dwReserved1=0x0, cFileName="04", cAlternateFileName="")) returned 1 [0219.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc295215e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0219.490] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc295215e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0219.491] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="109005", cAlternateFileName="")) returned 1 [0219.491] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0219.491] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0219.495] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0219.495] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0219.495] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0219.644] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.646] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.647] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.674] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.686] CloseHandle (hObject=0x200) returned 1 [0219.686] CloseHandle (hObject=0x1fc) returned 1 [0219.687] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.688] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.688] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109005", cAlternateFileName="")) returned 0x7e2548 [0219.689] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109005", cAlternateFileName="")) returned 0 [0219.689] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0219.689] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 1 [0219.690] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.690] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.690] CloseHandle (hObject=0xffffffff) returned 1 [0219.690] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.691] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D$\x07\x02D-\x07\x02(2@")) returned 0 [0219.691] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.691] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.691] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.691] CloseHandle (hObject=0xffffffff) returned 1 [0219.691] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.692] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="T$\x07\x02D-\x07\x02(2@")) returned 0 [0219.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.692] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.692] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.692] CloseHandle (hObject=0xffffffff) returned 1 [0219.692] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="d$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.694] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="d$\x07\x02D-\x07\x02(2@")) returned 0 [0219.694] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.694] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.695] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.695] CloseHandle (hObject=0xffffffff) returned 1 [0219.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.695] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0219.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.695] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.695] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.696] CloseHandle (hObject=0xffffffff) returned 1 [0219.696] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.696] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0219.696] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.696] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.696] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.696] CloseHandle (hObject=0xffffffff) returned 1 [0219.696] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.697] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0219.697] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.697] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.697] CloseHandle (hObject=0xffffffff) returned 1 [0219.697] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.698] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0219.698] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.698] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.698] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.698] CloseHandle (hObject=0xffffffff) returned 1 [0219.698] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.698] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.698] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0219.698] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.698] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.699] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.699] CloseHandle (hObject=0xffffffff) returned 1 [0219.699] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.699] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0219.699] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.699] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.699] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.699] CloseHandle (hObject=0xffffffff) returned 1 [0219.700] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.700] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.700] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02D-\x07\x02(2@")) returned 0 [0219.700] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.700] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.700] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.700] CloseHandle (hObject=0xffffffff) returned 1 [0219.700] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.700] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.701] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02D-\x07\x02(2@")) returned 0 [0219.701] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.701] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.701] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.701] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.701] CloseHandle (hObject=0xffffffff) returned 1 [0219.701] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.701] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.701] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.702] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02D-\x07\x02(2@")) returned 0 [0219.702] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.702] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.702] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.702] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.702] CloseHandle (hObject=0xffffffff) returned 1 [0219.702] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.702] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.702] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.703] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02D-\x07\x02(2@")) returned 0 [0219.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.703] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.703] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.703] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.703] CloseHandle (hObject=0xffffffff) returned 1 [0219.703] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.703] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.704] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02D-\x07\x02(2@")) returned 0 [0219.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.704] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.704] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.704] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.704] CloseHandle (hObject=0xffffffff) returned 1 [0219.704] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0 [0219.705] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005.z49-css-qhb")) returned 0x20 [0219.705] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0219.705] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02D-\x07\x02(2@")) returned 0 [0219.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.705] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.705] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\109005" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\109005")) returned 0xffffffff [0219.705] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="259", cAlternateFileName="")) returned 1 [0219.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0219.716] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0219.716] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0219.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0219.717] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0219.888] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.905] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0219.907] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.939] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.954] CloseHandle (hObject=0x1fc) returned 1 [0219.955] CloseHandle (hObject=0x200) returned 1 [0219.956] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.957] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.957] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="259", cAlternateFileName="")) returned 0x7e2c48 [0219.957] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="259", cAlternateFileName="")) returned 0 [0219.957] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0219.957] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 1 [0219.959] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.959] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.959] CloseHandle (hObject=0xffffffff) returned 1 [0219.959] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.960] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.960] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x020$\x07\x02(2@")) returned 0 [0219.960] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.960] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.961] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.961] CloseHandle (hObject=0xffffffff) returned 1 [0219.961] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.961] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.961] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x020$\x07\x02(2@")) returned 0 [0219.961] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.961] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.962] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.962] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.962] CloseHandle (hObject=0xffffffff) returned 1 [0219.962] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.962] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.963] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x020$\x07\x02(2@")) returned 0 [0219.963] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.963] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.963] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.963] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.963] CloseHandle (hObject=0xffffffff) returned 1 [0219.963] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.963] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.963] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.964] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x020$\x07\x02(2@")) returned 0 [0219.964] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.964] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.964] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.964] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.964] CloseHandle (hObject=0xffffffff) returned 1 [0219.964] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.964] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.964] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.965] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x020$\x07\x02(2@")) returned 0 [0219.965] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.965] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.965] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.965] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.965] CloseHandle (hObject=0xffffffff) returned 1 [0219.965] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.965] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.966] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.966] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x020$\x07\x02(2@")) returned 0 [0219.966] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.966] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.966] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.966] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.966] CloseHandle (hObject=0xffffffff) returned 1 [0219.966] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.967] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.967] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.967] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x020$\x07\x02(2@")) returned 0 [0219.967] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.967] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.967] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.967] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.967] CloseHandle (hObject=0xffffffff) returned 1 [0219.968] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.968] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.968] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.968] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x020$\x07\x02(2@")) returned 0 [0219.968] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.968] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.968] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.968] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.969] CloseHandle (hObject=0xffffffff) returned 1 [0219.969] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.969] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.969] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.969] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x020$\x07\x02(2@")) returned 0 [0219.969] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.969] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.969] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.970] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.970] CloseHandle (hObject=0xffffffff) returned 1 [0219.970] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.970] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.970] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.970] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x020$\x07\x02(2@")) returned 0 [0219.970] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.970] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.971] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.971] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.971] CloseHandle (hObject=0xffffffff) returned 1 [0219.971] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.971] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.971] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.971] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x020$\x07\x02(2@")) returned 0 [0219.971] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.972] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.972] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.972] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.972] CloseHandle (hObject=0xffffffff) returned 1 [0219.972] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.972] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.972] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.973] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x020$\x07\x02(2@")) returned 0 [0219.973] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.973] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.973] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.973] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.973] CloseHandle (hObject=0xffffffff) returned 1 [0219.973] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.973] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.973] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.975] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x020$\x07\x02(2@")) returned 0 [0219.975] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.975] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.976] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.976] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.976] CloseHandle (hObject=0xffffffff) returned 1 [0219.976] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.976] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.976] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.977] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x020$\x07\x02(2@")) returned 0 [0219.977] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.977] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.977] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.977] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0219.977] CloseHandle (hObject=0xffffffff) returned 1 [0219.977] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0 [0219.977] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259.z49-css-qhb")) returned 0x20 [0219.977] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x020$\x07\x02(2@")) returned 0xffffffff [0219.978] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x020$\x07\x02(2@")) returned 0 [0219.978] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0219.978] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04")) returned 0 [0219.978] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\259" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\04\\259")) returned 0xffffffff [0219.978] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="259", cAlternateFileName="")) returned 0 [0219.978] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0219.978] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc295291b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2e9d2d1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="05", cAlternateFileName="")) returned 1 [0219.978] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc295291b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2e9d2d1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0219.979] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc295291b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2e9d2d1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0219.979] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="191", cAlternateFileName="")) returned 1 [0219.979] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0219.979] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0219.980] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0219.980] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0219.981] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0220.067] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.071] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.073] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.103] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.117] CloseHandle (hObject=0x200) returned 1 [0220.118] CloseHandle (hObject=0x1fc) returned 1 [0220.119] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.120] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.120] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="191", cAlternateFileName="")) returned 0x7e2a48 [0220.120] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="191", cAlternateFileName="")) returned 0 [0220.120] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0220.121] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 1 [0220.122] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.122] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.123] CloseHandle (hObject=0xffffffff) returned 1 [0220.123] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.123] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.123] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.123] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0$\x07\x02D-\x07\x02(2@")) returned 0 [0220.123] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.123] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.124] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.124] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.124] CloseHandle (hObject=0xffffffff) returned 1 [0220.124] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.124] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.124] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.124] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0$\x07\x02D-\x07\x02(2@")) returned 0 [0220.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.125] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.125] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.125] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.125] CloseHandle (hObject=0xffffffff) returned 1 [0220.125] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.125] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.125] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.126] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0$\x07\x02D-\x07\x02(2@")) returned 0 [0220.126] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.126] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.126] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.126] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.126] CloseHandle (hObject=0xffffffff) returned 1 [0220.126] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.126] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.126] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.127] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.127] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.127] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.127] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.127] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.127] CloseHandle (hObject=0xffffffff) returned 1 [0220.127] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.127] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.128] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.128] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.128] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.128] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.128] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.128] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.128] CloseHandle (hObject=0xffffffff) returned 1 [0220.128] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.129] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.129] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.129] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.129] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.129] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.129] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.129] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.130] CloseHandle (hObject=0xffffffff) returned 1 [0220.130] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.130] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.130] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.130] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.131] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.131] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.131] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.131] CloseHandle (hObject=0xffffffff) returned 1 [0220.131] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.131] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.132] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.132] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.132] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.132] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.132] CloseHandle (hObject=0xffffffff) returned 1 [0220.132] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.132] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.133] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.133] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.133] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.133] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.133] CloseHandle (hObject=0xffffffff) returned 1 [0220.133] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.134] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.134] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0220.134] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.134] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.134] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.134] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.134] CloseHandle (hObject=0xffffffff) returned 1 [0220.135] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.135] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.135] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.135] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0220.135] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.135] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.135] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.135] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.136] CloseHandle (hObject=0xffffffff) returned 1 [0220.136] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.136] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.136] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.136] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0220.136] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.136] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.137] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.137] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.137] CloseHandle (hObject=0xffffffff) returned 1 [0220.137] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.137] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.137] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.137] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0220.137] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.138] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.138] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.138] CloseHandle (hObject=0xffffffff) returned 1 [0220.138] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.138] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.139] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0220.139] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.139] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.139] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.139] CloseHandle (hObject=0xffffffff) returned 1 [0220.139] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0 [0220.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191.z49-css-qhb")) returned 0x20 [0220.140] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.140] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0 [0220.140] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.140] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05")) returned 0 [0220.140] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\191" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\05\\191")) returned 0xffffffff [0220.140] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="191", cAlternateFileName="")) returned 0 [0220.140] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0220.141] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2952f6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2ec3520, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="09", cAlternateFileName="")) returned 1 [0220.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2952f6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2ec3520, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0220.141] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2952f6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2ec3520, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0220.141] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="287", cAlternateFileName="")) returned 1 [0220.142] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0220.147] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0220.148] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0220.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0220.148] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0220.234] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.238] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.240] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.276] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.292] CloseHandle (hObject=0x1fc) returned 1 [0220.292] CloseHandle (hObject=0x200) returned 1 [0220.295] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.296] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.296] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="287", cAlternateFileName="")) returned 0x7e2b08 [0220.296] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="287", cAlternateFileName="")) returned 0 [0220.296] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0220.296] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 1 [0220.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.298] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.298] CloseHandle (hObject=0xffffffff) returned 1 [0220.298] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.299] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0220.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.299] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.299] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.299] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.299] CloseHandle (hObject=0xffffffff) returned 1 [0220.299] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.300] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.300] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0220.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.300] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.300] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.301] CloseHandle (hObject=0xffffffff) returned 1 [0220.301] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.301] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.301] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.301] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0220.301] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.301] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.302] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.302] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.303] CloseHandle (hObject=0xffffffff) returned 1 [0220.303] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.303] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.303] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02`$\x07\x02(2@")) returned 0 [0220.303] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.303] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.304] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.304] CloseHandle (hObject=0xffffffff) returned 1 [0220.304] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.305] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02`$\x07\x02(2@")) returned 0 [0220.305] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.305] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.305] CloseHandle (hObject=0xffffffff) returned 1 [0220.305] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.306] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02`$\x07\x02(2@")) returned 0 [0220.306] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.306] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.306] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.306] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.306] CloseHandle (hObject=0xffffffff) returned 1 [0220.306] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.307] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02`$\x07\x02(2@")) returned 0 [0220.307] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.307] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.307] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.307] CloseHandle (hObject=0xffffffff) returned 1 [0220.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.308] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02`$\x07\x02(2@")) returned 0 [0220.308] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.308] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.309] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.309] CloseHandle (hObject=0xffffffff) returned 1 [0220.309] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.309] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02`$\x07\x02(2@")) returned 0 [0220.309] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.310] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.310] CloseHandle (hObject=0xffffffff) returned 1 [0220.310] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.311] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02`$\x07\x02(2@")) returned 0 [0220.311] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.311] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.311] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.311] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.311] CloseHandle (hObject=0xffffffff) returned 1 [0220.311] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.311] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.311] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.312] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02`$\x07\x02(2@")) returned 0 [0220.312] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.312] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.312] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.312] CloseHandle (hObject=0xffffffff) returned 1 [0220.312] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.313] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02`$\x07\x02(2@")) returned 0 [0220.313] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.313] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.313] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.313] CloseHandle (hObject=0xffffffff) returned 1 [0220.313] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.314] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02`$\x07\x02(2@")) returned 0 [0220.314] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.314] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.314] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.315] CloseHandle (hObject=0xffffffff) returned 1 [0220.315] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.315] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.315] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02`$\x07\x02(2@")) returned 0 [0220.315] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.315] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.315] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.316] CloseHandle (hObject=0xffffffff) returned 1 [0220.316] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0 [0220.316] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287.z49-css-qhb")) returned 0x20 [0220.316] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0220.316] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02`$\x07\x02(2@")) returned 0 [0220.316] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.316] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09")) returned 0 [0220.317] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\287" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\09\\287")) returned 0xffffffff [0220.317] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="287", cAlternateFileName="")) returned 0 [0220.317] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0220.317] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29537a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2ec3520, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0220.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29537a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2ec3520, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0220.317] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29537a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2ec3520, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0220.317] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="267", cAlternateFileName="")) returned 1 [0220.319] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0220.319] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0220.320] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0220.320] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0220.321] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0220.409] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.412] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.413] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.465] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.487] CloseHandle (hObject=0x200) returned 1 [0220.487] CloseHandle (hObject=0x1fc) returned 1 [0220.489] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="267", cAlternateFileName="")) returned 0x7e2888 [0220.491] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="267", cAlternateFileName="")) returned 0 [0220.491] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0220.491] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 1 [0220.492] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.492] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.493] CloseHandle (hObject=0xffffffff) returned 1 [0220.493] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.493] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.493] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.494] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80$\x07\x02D-\x07\x02(2@")) returned 0 [0220.494] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.494] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.494] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.494] CloseHandle (hObject=0xffffffff) returned 1 [0220.494] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.494] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x90$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.495] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x90$\x07\x02D-\x07\x02(2@")) returned 0 [0220.495] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.495] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.495] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.495] CloseHandle (hObject=0xffffffff) returned 1 [0220.496] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.496] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.496] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" $\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.496] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" $\x07\x02D-\x07\x02(2@")) returned 0 [0220.496] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.496] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.497] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.497] CloseHandle (hObject=0xffffffff) returned 1 [0220.497] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.497] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.498] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02D-\x07\x02(2@")) returned 0 [0220.498] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.498] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.498] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.498] CloseHandle (hObject=0xffffffff) returned 1 [0220.498] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.499] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.499] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.499] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.499] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.500] CloseHandle (hObject=0xffffffff) returned 1 [0220.500] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.500] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.500] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.500] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.501] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.501] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.501] CloseHandle (hObject=0xffffffff) returned 1 [0220.501] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.501] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.501] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.502] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.502] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.502] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.502] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.502] CloseHandle (hObject=0xffffffff) returned 1 [0220.502] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.503] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.503] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.503] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.503] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.503] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.503] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.503] CloseHandle (hObject=0xffffffff) returned 1 [0220.504] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.504] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.504] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.504] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.504] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.504] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.504] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.505] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.505] CloseHandle (hObject=0xffffffff) returned 1 [0220.505] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.507] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.507] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.507] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.507] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.507] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.508] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.508] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.508] CloseHandle (hObject=0xffffffff) returned 1 [0220.508] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.508] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.508] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.509] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0220.509] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.509] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.509] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.509] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.509] CloseHandle (hObject=0xffffffff) returned 1 [0220.509] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.509] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.510] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.510] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0220.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.510] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.510] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.510] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.511] CloseHandle (hObject=0xffffffff) returned 1 [0220.511] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.511] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.511] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.511] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0220.511] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.511] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.512] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.512] CloseHandle (hObject=0xffffffff) returned 1 [0220.512] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.512] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.513] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0220.513] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.513] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.513] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.513] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.513] CloseHandle (hObject=0xffffffff) returned 1 [0220.513] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0 [0220.513] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267.z49-css-qhb")) returned 0x20 [0220.513] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.514] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0220.514] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.514] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.514] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\267" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\267")) returned 0xffffffff [0220.514] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="286", cAlternateFileName="")) returned 1 [0220.515] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0220.515] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0220.516] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0220.516] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0220.516] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0220.695] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.697] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.698] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.730] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.743] CloseHandle (hObject=0x1fc) returned 1 [0220.744] CloseHandle (hObject=0x200) returned 1 [0220.745] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.746] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="286", cAlternateFileName="")) returned 0x7e2c48 [0220.746] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="286", cAlternateFileName="")) returned 0 [0220.746] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0220.747] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 1 [0220.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.750] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.750] CloseHandle (hObject=0xffffffff) returned 1 [0220.750] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0220.750] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0220.750] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.750] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.751] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.751] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.751] CloseHandle (hObject=0xffffffff) returned 1 [0220.751] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.751] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.751] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0220.751] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0220.751] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.751] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.752] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.752] CloseHandle (hObject=0xffffffff) returned 1 [0220.752] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.752] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0220.752] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0220.752] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.752] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.752] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.753] CloseHandle (hObject=0xffffffff) returned 1 [0220.753] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.753] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0220.753] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0220.753] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.753] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.753] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.753] CloseHandle (hObject=0xffffffff) returned 1 [0220.754] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.754] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02")) returned 0xffffffff [0220.754] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02")) returned 0 [0220.754] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.754] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.754] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.754] CloseHandle (hObject=0xffffffff) returned 1 [0220.754] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02")) returned 0xffffffff [0220.755] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02")) returned 0 [0220.755] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.755] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.755] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.755] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.755] CloseHandle (hObject=0xffffffff) returned 1 [0220.755] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.755] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02")) returned 0xffffffff [0220.756] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02")) returned 0 [0220.756] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.756] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.756] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.756] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.756] CloseHandle (hObject=0xffffffff) returned 1 [0220.756] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.756] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02")) returned 0xffffffff [0220.757] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02")) returned 0 [0220.757] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.757] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.757] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.757] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.757] CloseHandle (hObject=0xffffffff) returned 1 [0220.757] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.757] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02")) returned 0xffffffff [0220.757] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02")) returned 0 [0220.757] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.757] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.758] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.758] CloseHandle (hObject=0xffffffff) returned 1 [0220.758] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02")) returned 0xffffffff [0220.758] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02")) returned 0 [0220.758] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.758] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.759] CloseHandle (hObject=0xffffffff) returned 1 [0220.759] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.759] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02")) returned 0xffffffff [0220.759] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02")) returned 0 [0220.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.759] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.759] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.760] CloseHandle (hObject=0xffffffff) returned 1 [0220.760] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.760] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.760] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02")) returned 0xffffffff [0220.760] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02")) returned 0 [0220.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.760] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.760] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.761] CloseHandle (hObject=0xffffffff) returned 1 [0220.761] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.761] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.761] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02")) returned 0xffffffff [0220.761] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02")) returned 0 [0220.761] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.761] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.761] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.761] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.761] CloseHandle (hObject=0xffffffff) returned 1 [0220.762] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.762] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.762] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02")) returned 0xffffffff [0220.762] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02")) returned 0 [0220.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.762] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.762] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.762] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.762] CloseHandle (hObject=0xffffffff) returned 1 [0220.762] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0 [0220.762] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286.z49-css-qhb")) returned 0x20 [0220.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02")) returned 0xffffffff [0220.763] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02")) returned 0 [0220.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.763] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10")) returned 0 [0220.763] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\286" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\10\\286")) returned 0xffffffff [0220.763] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="286", cAlternateFileName="")) returned 0 [0220.763] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0220.763] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29540e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="11", cAlternateFileName="")) returned 1 [0220.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\11\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29540e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0220.764] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29540e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0220.764] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29540e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0220.764] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0220.764] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2954efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="12", cAlternateFileName="")) returned 1 [0220.764] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2954efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0220.766] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2954efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0220.766] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="194", cAlternateFileName="")) returned 1 [0220.766] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0220.767] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0220.767] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0220.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0220.768] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0220.836] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.838] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0220.839] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.863] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.878] CloseHandle (hObject=0x200) returned 1 [0220.879] CloseHandle (hObject=0x1fc) returned 1 [0220.880] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.880] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.880] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="194", cAlternateFileName="")) returned 0x7e2b88 [0220.881] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="194", cAlternateFileName="")) returned 0 [0220.881] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0220.881] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 1 [0220.892] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.893] CloseHandle (hObject=0xffffffff) returned 1 [0220.893] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.893] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.893] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0220.894] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.894] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.894] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.894] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.894] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.894] CloseHandle (hObject=0xffffffff) returned 1 [0220.894] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.894] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.894] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0220.894] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.895] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.895] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.895] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.895] CloseHandle (hObject=0xffffffff) returned 1 [0220.895] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.895] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0220.895] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.895] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.895] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.896] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.896] CloseHandle (hObject=0xffffffff) returned 1 [0220.896] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.896] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0220.896] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.896] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.896] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.896] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.896] CloseHandle (hObject=0xffffffff) returned 1 [0220.897] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.897] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.897] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.897] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.897] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.897] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.897] CloseHandle (hObject=0xffffffff) returned 1 [0220.897] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.898] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.898] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.898] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.898] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.898] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.898] CloseHandle (hObject=0xffffffff) returned 1 [0220.898] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.898] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.899] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.899] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.899] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.899] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.899] CloseHandle (hObject=0xffffffff) returned 1 [0220.899] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.899] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.899] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.899] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.899] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.900] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.900] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.900] CloseHandle (hObject=0xffffffff) returned 1 [0220.900] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.900] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.900] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.900] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.900] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.900] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.900] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.900] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.901] CloseHandle (hObject=0xffffffff) returned 1 [0220.901] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.901] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.901] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.901] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0220.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.901] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.901] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.901] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.901] CloseHandle (hObject=0xffffffff) returned 1 [0220.901] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.902] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.902] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0220.902] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.902] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.902] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.902] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.902] CloseHandle (hObject=0xffffffff) returned 1 [0220.902] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.902] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.903] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.903] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0220.903] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.903] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.903] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.903] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.903] CloseHandle (hObject=0xffffffff) returned 1 [0220.903] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.903] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.903] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.904] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0220.904] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.904] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.904] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.904] CloseHandle (hObject=0xffffffff) returned 1 [0220.904] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.904] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.904] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.905] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0220.905] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.905] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.905] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.905] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0220.905] CloseHandle (hObject=0xffffffff) returned 1 [0220.905] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0 [0220.905] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194.z49-css-qhb")) returned 0x20 [0220.905] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0220.906] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0220.906] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0220.906] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12")) returned 0 [0220.906] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\194" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\12\\194")) returned 0xffffffff [0220.906] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="194", cAlternateFileName="")) returned 0 [0220.906] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0220.906] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2955681, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2f5be9a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="15", cAlternateFileName="")) returned 1 [0220.906] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2955681, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2f5be9a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0220.906] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2955681, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2f5be9a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0220.906] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="196", cAlternateFileName="")) returned 1 [0220.907] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0220.907] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0220.908] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0220.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0220.908] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0221.028] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.029] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.030] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.054] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.067] CloseHandle (hObject=0x1fc) returned 1 [0221.067] CloseHandle (hObject=0x200) returned 1 [0221.068] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.069] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.069] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="196", cAlternateFileName="")) returned 0x7e2648 [0221.069] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="196", cAlternateFileName="")) returned 0 [0221.070] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0221.070] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 1 [0221.071] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.071] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.071] CloseHandle (hObject=0xffffffff) returned 1 [0221.071] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.071] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.071] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.071] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.072] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.072] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.072] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.072] CloseHandle (hObject=0xffffffff) returned 1 [0221.072] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.072] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.072] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.072] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.072] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.072] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.073] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.073] CloseHandle (hObject=0xffffffff) returned 1 [0221.073] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.073] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.073] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.073] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.073] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.073] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.073] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.073] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.073] CloseHandle (hObject=0xffffffff) returned 1 [0221.074] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.074] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.074] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.074] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.074] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.074] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.074] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.074] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.074] CloseHandle (hObject=0xffffffff) returned 1 [0221.074] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.075] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.075] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.075] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.075] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.075] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.075] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.075] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.075] CloseHandle (hObject=0xffffffff) returned 1 [0221.075] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.075] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.075] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.076] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.076] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.076] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.076] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.076] CloseHandle (hObject=0xffffffff) returned 1 [0221.076] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.077] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.077] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.077] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.077] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.077] CloseHandle (hObject=0xffffffff) returned 1 [0221.077] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.078] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.078] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.078] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.078] CloseHandle (hObject=0xffffffff) returned 1 [0221.078] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.079] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.079] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.079] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.079] CloseHandle (hObject=0xffffffff) returned 1 [0221.079] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.079] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.079] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.080] CloseHandle (hObject=0xffffffff) returned 1 [0221.080] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.080] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.080] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.081] CloseHandle (hObject=0xffffffff) returned 1 [0221.081] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.081] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.081] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.081] CloseHandle (hObject=0xffffffff) returned 1 [0221.081] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.082] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.082] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.082] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.082] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.082] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.082] CloseHandle (hObject=0xffffffff) returned 1 [0221.082] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.082] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.083] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.083] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.083] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.083] CloseHandle (hObject=0xffffffff) returned 1 [0221.083] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0 [0221.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196.z49-css-qhb")) returned 0x20 [0221.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.084] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.084] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.084] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\196" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\196")) returned 0xffffffff [0221.084] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="262", cAlternateFileName="")) returned 1 [0221.084] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0221.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0221.085] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0221.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0221.085] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0221.166] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.167] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.169] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.202] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.218] CloseHandle (hObject=0x200) returned 1 [0221.218] CloseHandle (hObject=0x1fc) returned 1 [0221.220] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.221] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="262", cAlternateFileName="")) returned 0x7e2a48 [0221.221] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="262", cAlternateFileName="")) returned 0 [0221.221] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0221.222] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 1 [0221.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.223] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.223] CloseHandle (hObject=0xffffffff) returned 1 [0221.223] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.224] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.224] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0 [0221.224] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.224] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.225] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.225] CloseHandle (hObject=0xffffffff) returned 1 [0221.225] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.225] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.225] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.225] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0 [0221.225] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.226] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.226] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.226] CloseHandle (hObject=0xffffffff) returned 1 [0221.226] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.226] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.227] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0 [0221.227] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.227] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.227] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.227] CloseHandle (hObject=0xffffffff) returned 1 [0221.227] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.228] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.228] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="<$\x07\x02D-\x07\x02(2@")) returned 0 [0221.228] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.228] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.228] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.228] CloseHandle (hObject=0xffffffff) returned 1 [0221.228] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.229] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.229] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0221.229] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.229] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.229] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.230] CloseHandle (hObject=0xffffffff) returned 1 [0221.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.230] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.230] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0221.230] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.230] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.231] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.231] CloseHandle (hObject=0xffffffff) returned 1 [0221.231] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.231] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0221.231] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.232] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.232] CloseHandle (hObject=0xffffffff) returned 1 [0221.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.234] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0221.234] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.234] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.234] CloseHandle (hObject=0xffffffff) returned 1 [0221.234] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.235] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0221.235] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.235] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.235] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.235] CloseHandle (hObject=0xffffffff) returned 1 [0221.235] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.236] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0221.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.236] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.236] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.237] CloseHandle (hObject=0xffffffff) returned 1 [0221.237] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.237] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.237] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0221.237] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.237] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.238] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.238] CloseHandle (hObject=0xffffffff) returned 1 [0221.238] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.238] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.238] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.238] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0221.238] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.238] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.239] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.239] CloseHandle (hObject=0xffffffff) returned 1 [0221.239] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.239] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.240] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0221.240] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.240] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.240] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.240] CloseHandle (hObject=0xffffffff) returned 1 [0221.240] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.241] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0221.241] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.241] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.241] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.241] CloseHandle (hObject=0xffffffff) returned 1 [0221.241] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0 [0221.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262.z49-css-qhb")) returned 0x20 [0221.242] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.242] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0221.242] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.242] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15")) returned 0 [0221.242] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\262" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\15\\262")) returned 0xffffffff [0221.242] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="262", cAlternateFileName="")) returned 0 [0221.242] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0221.242] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2955eb4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x353030, dwReserved1=0x0, cFileName="17", cAlternateFileName="")) returned 1 [0221.243] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2955eb4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0221.244] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2955eb4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0221.244] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="109001", cAlternateFileName="")) returned 1 [0221.245] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0221.245] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0221.246] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0221.246] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0221.247] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0221.343] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.344] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.347] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.380] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.395] CloseHandle (hObject=0x1fc) returned 1 [0221.396] CloseHandle (hObject=0x200) returned 1 [0221.399] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.400] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.400] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109001", cAlternateFileName="")) returned 0x7e2888 [0221.400] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109001", cAlternateFileName="")) returned 0 [0221.400] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0221.400] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 1 [0221.402] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.402] CloseHandle (hObject=0xffffffff) returned 1 [0221.402] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.402] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.403] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð#\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.403] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð#\x07\x02\\$\x07\x02(2@")) returned 0 [0221.403] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.403] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.403] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.403] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.404] CloseHandle (hObject=0xffffffff) returned 1 [0221.404] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.404] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.404] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð#\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.405] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð#\x07\x02\\$\x07\x02(2@")) returned 0 [0221.405] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.405] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.405] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.405] CloseHandle (hObject=0xffffffff) returned 1 [0221.405] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.406] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð#\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.406] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð#\x07\x02\\$\x07\x02(2@")) returned 0 [0221.406] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.406] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.407] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.407] CloseHandle (hObject=0xffffffff) returned 1 [0221.407] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.407] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.408] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.408] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.408] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.408] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.408] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.408] CloseHandle (hObject=0xffffffff) returned 1 [0221.408] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.409] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.409] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.409] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.409] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.409] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.410] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.410] CloseHandle (hObject=0xffffffff) returned 1 [0221.410] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.410] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.410] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.411] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.411] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.411] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.411] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.411] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.411] CloseHandle (hObject=0xffffffff) returned 1 [0221.411] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.411] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.411] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.412] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.412] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.412] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.412] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.412] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.412] CloseHandle (hObject=0xffffffff) returned 1 [0221.412] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.413] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.413] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.413] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.413] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.413] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.413] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.413] CloseHandle (hObject=0xffffffff) returned 1 [0221.414] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.414] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.414] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.414] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.414] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.414] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.414] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.415] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.415] CloseHandle (hObject=0xffffffff) returned 1 [0221.415] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.415] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.415] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.415] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.415] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.415] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.416] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.416] CloseHandle (hObject=0xffffffff) returned 1 [0221.416] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.417] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.417] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.417] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.417] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.417] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.417] CloseHandle (hObject=0xffffffff) returned 1 [0221.417] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.417] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.417] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.418] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.418] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.418] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.418] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.418] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.418] CloseHandle (hObject=0xffffffff) returned 1 [0221.418] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.419] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.419] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø-\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.419] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø-\x07\x02\\$\x07\x02(2@")) returned 0 [0221.419] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.419] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.419] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.419] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.420] CloseHandle (hObject=0xffffffff) returned 1 [0221.420] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08.\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.430] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08.\x07\x02\\$\x07\x02(2@")) returned 0 [0221.430] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.430] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.430] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.431] CloseHandle (hObject=0xffffffff) returned 1 [0221.431] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0 [0221.431] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001.z49-css-qhb")) returned 0x20 [0221.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18.\x07\x02\\$\x07\x02(2@")) returned 0xffffffff [0221.431] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18.\x07\x02\\$\x07\x02(2@")) returned 0 [0221.431] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.431] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.432] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\109001" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\109001")) returned 0xffffffff [0221.432] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="193", cAlternateFileName="")) returned 1 [0221.432] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0221.433] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0221.433] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0221.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0221.434] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0221.545] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.546] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.548] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.663] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.678] CloseHandle (hObject=0x200) returned 1 [0221.679] CloseHandle (hObject=0x1fc) returned 1 [0221.688] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.689] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.689] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="193", cAlternateFileName="")) returned 0x7e2a88 [0221.689] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="193", cAlternateFileName="")) returned 0 [0221.689] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0221.689] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 1 [0221.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.691] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.691] CloseHandle (hObject=0xffffffff) returned 1 [0221.691] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.692] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.692] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.692] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.693] CloseHandle (hObject=0xffffffff) returned 1 [0221.693] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.693] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.693] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.694] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.694] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.694] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.694] CloseHandle (hObject=0xffffffff) returned 1 [0221.694] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.694] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.695] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.695] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.695] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.695] CloseHandle (hObject=0xffffffff) returned 1 [0221.696] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.696] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.696] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.696] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.697] CloseHandle (hObject=0xffffffff) returned 1 [0221.697] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.698] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.698] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.698] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.698] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.698] CloseHandle (hObject=0xffffffff) returned 1 [0221.698] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.699] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.699] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.699] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.699] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.700] CloseHandle (hObject=0xffffffff) returned 1 [0221.700] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.700] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.700] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.700] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.700] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.701] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.701] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.701] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.701] CloseHandle (hObject=0xffffffff) returned 1 [0221.701] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.701] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.702] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.702] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.702] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.702] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.702] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.702] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.702] CloseHandle (hObject=0xffffffff) returned 1 [0221.703] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.703] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.703] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.703] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.703] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.704] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.704] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.704] CloseHandle (hObject=0xffffffff) returned 1 [0221.704] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.704] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.705] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.705] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.705] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.705] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.705] CloseHandle (hObject=0xffffffff) returned 1 [0221.705] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.706] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.706] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.707] CloseHandle (hObject=0xffffffff) returned 1 [0221.707] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.707] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.707] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.708] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.708] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.708] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.708] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.708] CloseHandle (hObject=0xffffffff) returned 1 [0221.708] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.708] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.708] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.709] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.709] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.709] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.709] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.709] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.709] CloseHandle (hObject=0xffffffff) returned 1 [0221.709] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.710] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.710] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.710] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.710] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.711] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.711] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.711] CloseHandle (hObject=0xffffffff) returned 1 [0221.711] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0 [0221.711] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193.z49-css-qhb")) returned 0x20 [0221.711] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02Ð#\x07\x02(2@")) returned 0xffffffff [0221.712] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02Ð#\x07\x02(2@")) returned 0 [0221.712] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.712] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17")) returned 0 [0221.712] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\193" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\17\\193")) returned 0xffffffff [0221.712] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="193", cAlternateFileName="")) returned 0 [0221.712] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0221.712] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2956545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2f82233, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x313030, dwReserved1=0x0, cFileName="18", cAlternateFileName="")) returned 1 [0221.712] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2956545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2f82233, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0221.713] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2956545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2f82233, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0221.713] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="109002", cAlternateFileName="")) returned 1 [0221.713] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0221.714] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0221.715] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0221.715] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0221.716] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0221.822] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.824] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0221.827] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.879] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.944] CloseHandle (hObject=0x1fc) returned 1 [0221.945] CloseHandle (hObject=0x200) returned 1 [0221.947] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.948] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.948] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109002", cAlternateFileName="")) returned 0x7e2c88 [0221.948] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109002", cAlternateFileName="")) returned 0 [0221.948] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0221.949] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 1 [0221.950] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.950] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.950] CloseHandle (hObject=0xffffffff) returned 1 [0221.950] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.951] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.951] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.951] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.951] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.951] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.951] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.952] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.952] CloseHandle (hObject=0xffffffff) returned 1 [0221.952] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.952] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.952] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.952] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.952] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.953] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.953] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.953] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.953] CloseHandle (hObject=0xffffffff) returned 1 [0221.953] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.953] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.953] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.954] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.954] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.954] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.954] CloseHandle (hObject=0xffffffff) returned 1 [0221.954] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.955] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.955] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.955] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.957] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.957] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.957] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.957] CloseHandle (hObject=0xffffffff) returned 1 [0221.957] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.957] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.958] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.958] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.958] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.958] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.959] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.959] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.959] CloseHandle (hObject=0xffffffff) returned 1 [0221.959] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.959] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.959] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.960] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.960] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.960] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.960] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.960] CloseHandle (hObject=0xffffffff) returned 1 [0221.961] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.961] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.961] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.961] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.962] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.962] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.962] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.962] CloseHandle (hObject=0xffffffff) returned 1 [0221.962] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.962] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.963] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.963] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.963] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.963] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.963] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.963] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.964] CloseHandle (hObject=0xffffffff) returned 1 [0221.964] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.964] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.964] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.966] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0221.966] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.966] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.966] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.966] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.966] CloseHandle (hObject=0xffffffff) returned 1 [0221.966] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.967] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.967] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.967] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02D-\x07\x02(2@")) returned 0 [0221.967] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.967] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.967] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.968] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.968] CloseHandle (hObject=0xffffffff) returned 1 [0221.968] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.968] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.968] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.969] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02D-\x07\x02(2@")) returned 0 [0221.969] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.969] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.969] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.969] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.969] CloseHandle (hObject=0xffffffff) returned 1 [0221.969] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.970] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.970] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.970] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02D-\x07\x02(2@")) returned 0 [0221.970] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.970] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.970] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.971] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.971] CloseHandle (hObject=0xffffffff) returned 1 [0221.971] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.971] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.971] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.974] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02D-\x07\x02(2@")) returned 0 [0221.974] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.974] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.975] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.975] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.975] CloseHandle (hObject=0xffffffff) returned 1 [0221.975] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.975] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.975] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.976] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02D-\x07\x02(2@")) returned 0 [0221.976] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.976] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.976] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.976] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0221.976] CloseHandle (hObject=0xffffffff) returned 1 [0221.977] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0 [0221.977] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002.z49-css-qhb")) returned 0x20 [0221.977] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0221.977] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02D-\x07\x02(2@")) returned 0 [0221.977] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0221.977] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0221.978] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\109002" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\109002")) returned 0xffffffff [0221.978] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="195", cAlternateFileName="")) returned 1 [0221.978] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0221.979] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0221.979] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0221.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0221.980] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0222.151] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0222.153] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0222.194] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.252] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.281] CloseHandle (hObject=0x200) returned 1 [0222.281] CloseHandle (hObject=0x1fc) returned 1 [0222.283] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.284] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.284] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="195", cAlternateFileName="")) returned 0x7e2a48 [0222.284] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="195", cAlternateFileName="")) returned 0 [0222.284] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0222.284] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 1 [0222.286] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.286] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.286] CloseHandle (hObject=0xffffffff) returned 1 [0222.286] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.286] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.286] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0222.286] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0222.286] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.286] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.287] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.287] CloseHandle (hObject=0xffffffff) returned 1 [0222.287] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0222.287] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0222.288] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.288] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.288] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.288] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.288] CloseHandle (hObject=0xffffffff) returned 1 [0222.288] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.288] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0222.289] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0222.289] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.289] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.289] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.289] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.289] CloseHandle (hObject=0xffffffff) returned 1 [0222.289] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.289] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02")) returned 0xffffffff [0222.290] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02")) returned 0 [0222.290] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.290] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.290] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.290] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.290] CloseHandle (hObject=0xffffffff) returned 1 [0222.290] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.290] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02")) returned 0xffffffff [0222.291] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02")) returned 0 [0222.291] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.291] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.291] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.291] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.291] CloseHandle (hObject=0xffffffff) returned 1 [0222.291] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.292] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.292] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02")) returned 0xffffffff [0222.292] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02")) returned 0 [0222.292] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.292] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.292] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.292] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.292] CloseHandle (hObject=0xffffffff) returned 1 [0222.293] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.293] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02")) returned 0xffffffff [0222.293] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02")) returned 0 [0222.293] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.293] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.293] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.294] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.294] CloseHandle (hObject=0xffffffff) returned 1 [0222.294] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02")) returned 0xffffffff [0222.295] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02")) returned 0 [0222.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.295] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.295] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.295] CloseHandle (hObject=0xffffffff) returned 1 [0222.295] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.295] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.295] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02")) returned 0xffffffff [0222.296] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02")) returned 0 [0222.296] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.296] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.296] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.296] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.296] CloseHandle (hObject=0xffffffff) returned 1 [0222.296] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.297] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.297] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02")) returned 0xffffffff [0222.297] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02")) returned 0 [0222.297] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.297] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.297] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.297] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.298] CloseHandle (hObject=0xffffffff) returned 1 [0222.298] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02")) returned 0xffffffff [0222.298] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02")) returned 0 [0222.298] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.298] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.299] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.299] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.299] CloseHandle (hObject=0xffffffff) returned 1 [0222.299] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.299] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.299] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02")) returned 0xffffffff [0222.306] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02")) returned 0 [0222.306] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.334] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.334] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.334] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.335] CloseHandle (hObject=0xffffffff) returned 1 [0222.335] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.335] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.335] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02")) returned 0xffffffff [0222.335] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02")) returned 0 [0222.336] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.336] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.336] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.336] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.336] CloseHandle (hObject=0xffffffff) returned 1 [0222.336] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.336] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02")) returned 0xffffffff [0222.337] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02")) returned 0 [0222.337] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.337] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.337] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.337] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.337] CloseHandle (hObject=0xffffffff) returned 1 [0222.337] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0 [0222.338] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195.z49-css-qhb")) returned 0x20 [0222.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02")) returned 0xffffffff [0222.338] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02")) returned 0 [0222.338] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.338] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18")) returned 0 [0222.338] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\195" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\18\\195")) returned 0xffffffff [0222.338] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="195", cAlternateFileName="")) returned 0 [0222.338] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0222.339] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2956d56, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x323030, dwReserved1=0x0, cFileName="19", cAlternateFileName="")) returned 1 [0222.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2956d56, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0222.339] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2956d56, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0222.339] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="266", cAlternateFileName="")) returned 1 [0222.339] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0222.340] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0222.340] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0222.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0222.341] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0222.420] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0222.422] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0222.423] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.452] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.499] CloseHandle (hObject=0x1fc) returned 1 [0222.500] CloseHandle (hObject=0x200) returned 1 [0222.504] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.505] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.505] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="266", cAlternateFileName="")) returned 0x7e2a48 [0222.506] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="266", cAlternateFileName="")) returned 0 [0222.506] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0222.506] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 1 [0222.507] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.507] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.508] CloseHandle (hObject=0xffffffff) returned 1 [0222.508] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.510] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.510] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0222.511] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0222.511] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.512] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.512] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.513] CloseHandle (hObject=0xffffffff) returned 1 [0222.513] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.514] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.515] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0222.517] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0222.517] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.517] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.521] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.535] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.535] CloseHandle (hObject=0xffffffff) returned 1 [0222.535] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.535] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.535] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0222.536] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0222.536] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.536] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.536] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.536] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.537] CloseHandle (hObject=0xffffffff) returned 1 [0222.537] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.537] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.537] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.537] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0222.537] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.538] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.538] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.538] CloseHandle (hObject=0xffffffff) returned 1 [0222.538] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.539] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0222.539] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.539] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.539] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.539] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.539] CloseHandle (hObject=0xffffffff) returned 1 [0222.539] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.539] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.540] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.540] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0222.540] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.540] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.540] CloseHandle (hObject=0xffffffff) returned 1 [0222.540] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.541] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.541] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.541] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0222.541] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.541] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.541] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.541] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.541] CloseHandle (hObject=0xffffffff) returned 1 [0222.541] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.542] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.542] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.542] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0222.542] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.542] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.542] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.542] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.542] CloseHandle (hObject=0xffffffff) returned 1 [0222.542] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.542] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.543] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.543] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0222.543] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.543] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.543] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.543] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.543] CloseHandle (hObject=0xffffffff) returned 1 [0222.543] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.543] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.544] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.544] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0222.544] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.544] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.544] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.544] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.544] CloseHandle (hObject=0xffffffff) returned 1 [0222.544] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.544] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.545] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.545] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0222.545] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.545] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.545] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.545] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.545] CloseHandle (hObject=0xffffffff) returned 1 [0222.545] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.545] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.545] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.546] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0222.546] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.546] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.546] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.546] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.546] CloseHandle (hObject=0xffffffff) returned 1 [0222.546] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.546] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.546] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.547] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0222.547] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.547] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.547] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.547] CloseHandle (hObject=0xffffffff) returned 1 [0222.547] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.547] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0222.547] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.547] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.548] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.548] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.548] CloseHandle (hObject=0xffffffff) returned 1 [0222.548] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0 [0222.548] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266.z49-css-qhb")) returned 0x20 [0222.548] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0222.548] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0 [0222.548] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.548] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.548] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\266" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\266")) returned 0xffffffff [0222.548] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="272", cAlternateFileName="")) returned 1 [0222.549] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0222.549] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0222.644] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0222.645] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0222.645] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0222.762] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0222.770] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0222.816] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.849] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.878] CloseHandle (hObject=0x200) returned 1 [0222.878] CloseHandle (hObject=0x1fc) returned 1 [0222.879] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.880] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.880] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="272", cAlternateFileName="")) returned 0x7e2b88 [0222.881] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="272", cAlternateFileName="")) returned 0 [0222.881] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0222.881] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 1 [0222.882] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.882] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.882] CloseHandle (hObject=0xffffffff) returned 1 [0222.882] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.882] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.882] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0222.883] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0222.883] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.883] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.883] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.883] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.883] CloseHandle (hObject=0xffffffff) returned 1 [0222.883] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.883] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.883] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0222.884] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0222.884] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.884] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.884] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.884] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.884] CloseHandle (hObject=0xffffffff) returned 1 [0222.884] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.884] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.884] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0xffffffff [0222.885] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02")) returned 0 [0222.885] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.885] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.885] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.885] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.885] CloseHandle (hObject=0xffffffff) returned 1 [0222.885] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.885] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.885] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02")) returned 0xffffffff [0222.886] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02")) returned 0 [0222.886] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.886] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.886] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.886] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.886] CloseHandle (hObject=0xffffffff) returned 1 [0222.886] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.886] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.887] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02")) returned 0xffffffff [0222.887] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02")) returned 0 [0222.887] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.887] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.887] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.887] CloseHandle (hObject=0xffffffff) returned 1 [0222.887] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.888] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.888] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02")) returned 0xffffffff [0222.888] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02")) returned 0 [0222.888] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.888] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.888] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.888] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.888] CloseHandle (hObject=0xffffffff) returned 1 [0222.889] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.889] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02")) returned 0xffffffff [0222.889] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02")) returned 0 [0222.889] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.889] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.890] CloseHandle (hObject=0xffffffff) returned 1 [0222.890] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.890] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.890] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02")) returned 0xffffffff [0222.891] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02")) returned 0 [0222.891] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.891] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.891] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.891] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.891] CloseHandle (hObject=0xffffffff) returned 1 [0222.891] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.891] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.891] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02")) returned 0xffffffff [0222.892] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02")) returned 0 [0222.892] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.892] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.892] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.892] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.892] CloseHandle (hObject=0xffffffff) returned 1 [0222.893] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.893] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.893] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02")) returned 0xffffffff [0222.893] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02")) returned 0 [0222.893] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.893] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.893] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.894] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.894] CloseHandle (hObject=0xffffffff) returned 1 [0222.894] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.894] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.895] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02")) returned 0xffffffff [0222.895] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02")) returned 0 [0222.895] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.895] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.895] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.895] CloseHandle (hObject=0xffffffff) returned 1 [0222.896] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.896] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02")) returned 0xffffffff [0222.896] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02")) returned 0 [0222.896] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.896] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.897] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.897] CloseHandle (hObject=0xffffffff) returned 1 [0222.897] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.897] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02")) returned 0xffffffff [0222.897] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02")) returned 0 [0222.897] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.897] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.897] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.897] CloseHandle (hObject=0xffffffff) returned 1 [0222.898] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.898] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02")) returned 0xffffffff [0222.898] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02")) returned 0 [0222.898] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.898] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.898] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.898] CloseHandle (hObject=0xffffffff) returned 1 [0222.898] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0 [0222.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272.z49-css-qhb")) returned 0x20 [0222.899] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02")) returned 0xffffffff [0222.899] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02")) returned 0 [0222.899] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0222.899] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0222.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\272" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\272")) returned 0xffffffff [0222.899] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="328", cAlternateFileName="")) returned 1 [0222.899] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0222.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0222.952] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0222.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0222.952] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0223.024] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.028] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.029] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.055] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.068] CloseHandle (hObject=0x1fc) returned 1 [0223.068] CloseHandle (hObject=0x200) returned 1 [0223.073] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.073] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.074] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="328", cAlternateFileName="")) returned 0x7e2a48 [0223.074] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="328", cAlternateFileName="")) returned 0 [0223.074] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0223.074] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 1 [0223.075] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.075] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.075] CloseHandle (hObject=0xffffffff) returned 1 [0223.075] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.075] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.076] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0223.076] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.076] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.076] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.076] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.076] CloseHandle (hObject=0xffffffff) returned 1 [0223.076] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.076] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.076] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0223.077] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.077] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.077] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.077] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.077] CloseHandle (hObject=0xffffffff) returned 1 [0223.077] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.077] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0223.077] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.077] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.078] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.078] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.078] CloseHandle (hObject=0xffffffff) returned 1 [0223.078] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.078] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0223.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.078] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.079] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.079] CloseHandle (hObject=0xffffffff) returned 1 [0223.079] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.079] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0223.079] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.079] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.080] CloseHandle (hObject=0xffffffff) returned 1 [0223.080] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.080] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0223.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.080] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.080] CloseHandle (hObject=0xffffffff) returned 1 [0223.080] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.081] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0223.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.081] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.081] CloseHandle (hObject=0xffffffff) returned 1 [0223.081] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.082] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.082] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0223.082] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.082] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.082] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.082] CloseHandle (hObject=0xffffffff) returned 1 [0223.082] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.083] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02D-\x07\x02(2@")) returned 0 [0223.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.083] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.083] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.083] CloseHandle (hObject=0xffffffff) returned 1 [0223.083] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.084] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02D-\x07\x02(2@")) returned 0 [0223.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.084] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.084] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.084] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.084] CloseHandle (hObject=0xffffffff) returned 1 [0223.084] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.084] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.084] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.084] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02D-\x07\x02(2@")) returned 0 [0223.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.084] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.085] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.085] CloseHandle (hObject=0xffffffff) returned 1 [0223.085] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.085] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.085] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.085] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02D-\x07\x02(2@")) returned 0 [0223.085] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.085] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.085] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.086] CloseHandle (hObject=0xffffffff) returned 1 [0223.086] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.086] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.086] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.086] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02D-\x07\x02(2@")) returned 0 [0223.086] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.086] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.086] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.086] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.086] CloseHandle (hObject=0xffffffff) returned 1 [0223.086] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.087] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.087] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.087] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02D-\x07\x02(2@")) returned 0 [0223.087] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.087] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.087] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.087] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.087] CloseHandle (hObject=0xffffffff) returned 1 [0223.087] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0 [0223.087] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328.z49-css-qhb")) returned 0x20 [0223.087] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.088] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02D-\x07\x02(2@")) returned 0 [0223.088] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.088] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19")) returned 0 [0223.088] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\328" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\19\\328")) returned 0xffffffff [0223.088] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="328", cAlternateFileName="")) returned 0 [0223.088] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0223.088] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29575a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x323030, dwReserved1=0x0, cFileName="21", cAlternateFileName="")) returned 1 [0223.088] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29575a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0223.088] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc29575a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa22bde00, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0223.088] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="260", cAlternateFileName="")) returned 1 [0223.089] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0223.089] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0223.090] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0223.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0223.090] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0223.169] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.171] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.172] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.205] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.217] CloseHandle (hObject=0x200) returned 1 [0223.218] CloseHandle (hObject=0x1fc) returned 1 [0223.220] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.221] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="260", cAlternateFileName="")) returned 0x7e2a48 [0223.223] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="260", cAlternateFileName="")) returned 0 [0223.223] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0223.223] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 1 [0223.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.224] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.225] CloseHandle (hObject=0xffffffff) returned 1 [0223.225] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.225] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.225] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.225] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0223.225] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.225] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.226] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.226] CloseHandle (hObject=0xffffffff) returned 1 [0223.226] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.226] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.227] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0223.227] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.227] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.227] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.227] CloseHandle (hObject=0xffffffff) returned 1 [0223.227] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.227] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.228] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0223.228] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.228] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.228] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.228] CloseHandle (hObject=0xffffffff) returned 1 [0223.228] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.228] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.229] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="T-\x07\x02`$\x07\x02(2@")) returned 0 [0223.229] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.229] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.229] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.229] CloseHandle (hObject=0xffffffff) returned 1 [0223.229] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.229] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.229] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="d-\x07\x02`$\x07\x02(2@")) returned 0 [0223.230] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.230] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.230] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.230] CloseHandle (hObject=0xffffffff) returned 1 [0223.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.230] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.230] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t-\x07\x02`$\x07\x02(2@")) returned 0 [0223.230] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.230] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.231] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.231] CloseHandle (hObject=0xffffffff) returned 1 [0223.231] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.231] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84-\x07\x02`$\x07\x02(2@")) returned 0 [0223.231] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.231] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.232] CloseHandle (hObject=0xffffffff) returned 1 [0223.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.232] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94-\x07\x02`$\x07\x02(2@")) returned 0 [0223.232] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.232] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.232] CloseHandle (hObject=0xffffffff) returned 1 [0223.233] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.233] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¤-\x07\x02`$\x07\x02(2@")) returned 0 [0223.233] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.233] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.233] CloseHandle (hObject=0xffffffff) returned 1 [0223.233] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.234] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´-\x07\x02`$\x07\x02(2@")) returned 0 [0223.234] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.234] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.234] CloseHandle (hObject=0xffffffff) returned 1 [0223.234] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.235] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä-\x07\x02`$\x07\x02(2@")) returned 0 [0223.235] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.235] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.235] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.235] CloseHandle (hObject=0xffffffff) returned 1 [0223.235] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.236] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô-\x07\x02`$\x07\x02(2@")) returned 0 [0223.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.236] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.236] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.236] CloseHandle (hObject=0xffffffff) returned 1 [0223.236] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.236] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02`$\x07\x02(2@")) returned 0 [0223.237] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.237] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.237] CloseHandle (hObject=0xffffffff) returned 1 [0223.237] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.239] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.240] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02`$\x07\x02(2@")) returned 0 [0223.240] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.240] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.240] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.240] CloseHandle (hObject=0xffffffff) returned 1 [0223.240] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0 [0223.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260.z49-css-qhb")) returned 0x20 [0223.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.241] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02`$\x07\x02(2@")) returned 0 [0223.241] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.241] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21")) returned 0 [0223.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\260" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\21\\260")) returned 0xffffffff [0223.241] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22bde00, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa22bde00, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="260", cAlternateFileName="")) returned 0 [0223.241] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0223.241] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2957eed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x323030, dwReserved1=0x0, cFileName="22", cAlternateFileName="")) returned 1 [0223.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2957eed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0223.243] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2957eed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0223.243] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="109003", cAlternateFileName="")) returned 1 [0223.243] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0223.244] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0223.244] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0223.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0223.244] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0223.338] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.339] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.341] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.372] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.427] CloseHandle (hObject=0x1fc) returned 1 [0223.427] CloseHandle (hObject=0x200) returned 1 [0223.430] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.431] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109003", cAlternateFileName="")) returned 0x7e2c08 [0223.431] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109003", cAlternateFileName="")) returned 0 [0223.431] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0223.432] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 1 [0223.433] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.433] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.433] CloseHandle (hObject=0xffffffff) returned 1 [0223.433] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.434] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.434] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84$\x07\x02D-\x07\x02(2@")) returned 0 [0223.434] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.434] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.435] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.435] CloseHandle (hObject=0xffffffff) returned 1 [0223.435] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.435] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.435] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x94$\x07\x02D-\x07\x02(2@")) returned 0 [0223.436] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.436] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.436] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.436] CloseHandle (hObject=0xffffffff) returned 1 [0223.436] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.436] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.436] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¤$\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.437] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¤$\x07\x02D-\x07\x02(2@")) returned 0 [0223.437] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.437] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.437] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.437] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.437] CloseHandle (hObject=0xffffffff) returned 1 [0223.437] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.438] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.438] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.438] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0223.438] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.438] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.438] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.438] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.439] CloseHandle (hObject=0xffffffff) returned 1 [0223.439] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.439] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.439] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.439] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0223.439] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.439] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.439] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.440] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.440] CloseHandle (hObject=0xffffffff) returned 1 [0223.440] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.440] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.440] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.441] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0223.441] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.441] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.441] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.441] CloseHandle (hObject=0xffffffff) returned 1 [0223.441] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.442] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0223.442] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.442] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.442] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.442] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.442] CloseHandle (hObject=0xffffffff) returned 1 [0223.442] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.443] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.443] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0223.443] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.443] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.443] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.443] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.444] CloseHandle (hObject=0xffffffff) returned 1 [0223.444] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.444] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.444] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02D-\x07\x02(2@")) returned 0 [0223.444] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.444] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.444] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.445] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.445] CloseHandle (hObject=0xffffffff) returned 1 [0223.445] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.445] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.445] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.445] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02D-\x07\x02(2@")) returned 0 [0223.445] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.445] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.446] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.446] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.446] CloseHandle (hObject=0xffffffff) returned 1 [0223.446] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.446] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.446] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.446] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02D-\x07\x02(2@")) returned 0 [0223.447] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.447] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.447] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.447] CloseHandle (hObject=0xffffffff) returned 1 [0223.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.447] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.448] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02D-\x07\x02(2@")) returned 0 [0223.448] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.448] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.448] CloseHandle (hObject=0xffffffff) returned 1 [0223.448] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.449] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.449] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02D-\x07\x02(2@")) returned 0 [0223.449] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.449] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.449] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.449] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.449] CloseHandle (hObject=0xffffffff) returned 1 [0223.449] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.450] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02D-\x07\x02(2@")) returned 0 [0223.450] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.450] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.450] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.451] CloseHandle (hObject=0xffffffff) returned 1 [0223.451] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0 [0223.451] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003.z49-css-qhb")) returned 0x20 [0223.451] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02D-\x07\x02(2@")) returned 0xffffffff [0223.451] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02D-\x07\x02(2@")) returned 0 [0223.451] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.451] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109003" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109003")) returned 0xffffffff [0223.452] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="109006", cAlternateFileName="")) returned 1 [0223.452] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0223.453] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0223.469] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88 [0223.469] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0223.469] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0223.645] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.646] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x88, lpOverlapped=0x0) returned 1 [0223.647] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.703] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.716] CloseHandle (hObject=0x200) returned 1 [0223.717] CloseHandle (hObject=0x1fc) returned 1 [0223.719] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.720] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109006", cAlternateFileName="")) returned 0x7e2888 [0223.720] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="109006", cAlternateFileName="")) returned 0 [0223.721] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0223.721] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 1 [0223.722] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.722] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.722] CloseHandle (hObject=0xffffffff) returned 1 [0223.722] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.723] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.723] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0223.723] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.723] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.723] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.724] CloseHandle (hObject=0xffffffff) returned 1 [0223.724] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.724] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.724] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.724] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0223.724] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.724] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.724] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.725] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.725] CloseHandle (hObject=0xffffffff) returned 1 [0223.725] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.725] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.725] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.725] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="D-\x07\x02`$\x07\x02(2@")) returned 0 [0223.726] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.726] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.726] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.726] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.726] CloseHandle (hObject=0xffffffff) returned 1 [0223.726] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.726] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.726] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="X-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.726] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="X-\x07\x02`$\x07\x02(2@")) returned 0 [0223.726] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.727] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.727] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.727] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.727] CloseHandle (hObject=0xffffffff) returned 1 [0223.727] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.727] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.727] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.727] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h-\x07\x02`$\x07\x02(2@")) returned 0 [0223.727] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.727] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.728] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.728] CloseHandle (hObject=0xffffffff) returned 1 [0223.728] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.728] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="x-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.728] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="x-\x07\x02`$\x07\x02(2@")) returned 0 [0223.728] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.728] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.729] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.729] CloseHandle (hObject=0xffffffff) returned 1 [0223.729] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.729] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.729] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.729] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88-\x07\x02`$\x07\x02(2@")) returned 0 [0223.729] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.729] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.729] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.730] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.730] CloseHandle (hObject=0xffffffff) returned 1 [0223.730] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.730] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98-\x07\x02`$\x07\x02(2@")) returned 0 [0223.730] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.730] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.730] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.731] CloseHandle (hObject=0xffffffff) returned 1 [0223.731] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.731] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.731] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.731] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨-\x07\x02`$\x07\x02(2@")) returned 0 [0223.731] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.731] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.731] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.732] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.732] CloseHandle (hObject=0xffffffff) returned 1 [0223.732] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.732] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.732] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.732] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸-\x07\x02`$\x07\x02(2@")) returned 0 [0223.732] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.732] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.733] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.733] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.733] CloseHandle (hObject=0xffffffff) returned 1 [0223.733] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.733] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.733] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.734] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È-\x07\x02`$\x07\x02(2@")) returned 0 [0223.734] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.734] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.734] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.734] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.734] CloseHandle (hObject=0xffffffff) returned 1 [0223.734] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.734] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.734] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.735] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø-\x07\x02`$\x07\x02(2@")) returned 0 [0223.735] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.735] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.735] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.735] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.735] CloseHandle (hObject=0xffffffff) returned 1 [0223.735] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.735] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.735] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.736] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è-\x07\x02`$\x07\x02(2@")) returned 0 [0223.736] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.736] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.736] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.736] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.736] CloseHandle (hObject=0xffffffff) returned 1 [0223.736] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.736] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.736] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø-\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.736] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø-\x07\x02`$\x07\x02(2@")) returned 0 [0223.737] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.737] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.737] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.737] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.737] CloseHandle (hObject=0xffffffff) returned 1 [0223.737] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0 [0223.740] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006.z49-css-qhb")) returned 0x20 [0223.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08.\x07\x02`$\x07\x02(2@")) returned 0xffffffff [0223.741] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08.\x07\x02`$\x07\x02(2@")) returned 0 [0223.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0223.741] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22")) returned 0 [0223.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\109006" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\mput\\mputhistory\\22\\109006")) returned 0xffffffff [0223.741] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa2297c25, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x356bdc8f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="109006", cAlternateFileName="")) returned 0 [0223.741] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0223.741] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc2957eed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2297c25, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x323030, dwReserved1=0x0, cFileName="22", cAlternateFileName="")) returned 0 [0223.741] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0223.741] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28ab6dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3040e3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="MputHistory", cAlternateFileName="MPUTHI~1")) returned 0 [0223.741] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0223.742] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="RemCheck", cAlternateFileName="")) returned 1 [0223.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0223.742] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.742] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0223.742] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0223.742] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="Results", cAlternateFileName="")) returned 1 [0223.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0223.743] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.743] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0223.743] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0223.744] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="Service", cAlternateFileName="")) returned 1 [0223.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0223.744] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.744] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0223.744] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0223.744] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="Store", cAlternateFileName="")) returned 1 [0223.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0223.745] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.745] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0223.745] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0223.745] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="Store", cAlternateFileName="")) returned 0 [0223.745] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0223.745] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29db382, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65636572, dwReserved1=0x6567616b, cFileName="MetaStore", cAlternateFileName="METAST~1")) returned 1 [0223.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29db382, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0223.746] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29db382, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="..", cAlternateFileName="")) returned 1 [0223.746] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="1", cAlternateFileName="")) returned 1 [0223.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0223.746] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.746] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0223.746] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0223.746] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dc87e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="2", cAlternateFileName="")) returned 1 [0223.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dc87e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0223.746] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dc87e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.747] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a331af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="94", cAlternateFileName="")) returned 1 [0223.747] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a331af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0223.750] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a331af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0223.750] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7710f5c8, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="A75BFDE52F3DD8E6.dat", cAlternateFileName="A75BFD~1.DAT")) returned 1 [0223.750] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0223.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0223.753] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d9 [0223.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0223.753] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0223.830] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x13d9, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x13d9, lpOverlapped=0x0) returned 1 [0223.833] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x13d9, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x13d9, lpOverlapped=0x0) returned 1 [0223.834] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.860] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.874] CloseHandle (hObject=0x1f0) returned 1 [0223.875] CloseHandle (hObject=0x1fc) returned 1 [0223.883] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.z49-css-qhb")) returned 0 [0223.883] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.z49-css-qhb")) returned 0x20 [0223.883] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7710f5c8, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="A75BFDE52F3DD8E6.dat", cAlternateFileName="A75BFD~1.DAT")) returned 0x7e2508 [0223.884] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7710f5c8, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="A75BFDE52F3DD8E6.dat", cAlternateFileName="A75BFD~1.DAT")) returned 0 [0223.884] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0223.884] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 1 [0223.885] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 0xffffffff [0223.885] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7710f5c8, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="A75BFDE52F3DD8E6.dat", cAlternateFileName="A75BFD~1.DAT")) returned 0 [0223.885] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0223.885] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a331af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="94", cAlternateFileName="")) returned 0 [0223.885] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0223.886] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="3", cAlternateFileName="")) returned 1 [0223.886] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45444642, dwReserved1=0x33463235, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0223.886] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45444642, dwReserved1=0x33463235, cFileName="..", cAlternateFileName="")) returned 1 [0223.886] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45444642, dwReserved1=0x33463235, cFileName="..", cAlternateFileName="")) returned 0 [0223.886] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0223.886] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="4", cAlternateFileName="")) returned 1 [0223.886] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45444642, dwReserved1=0x33463235, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0223.886] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45444642, dwReserved1=0x33463235, cFileName="..", cAlternateFileName="")) returned 1 [0223.886] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45444642, dwReserved1=0x33463235, cFileName="..", cAlternateFileName="")) returned 0 [0223.887] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0223.887] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73694874, dwReserved1=0x79726f74, cFileName="4", cAlternateFileName="")) returned 0 [0223.887] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0223.887] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fab0876, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2fab0876, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x65636572, dwReserved1=0x6567616b, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", cAlternateFileName="")) returned 1 [0223.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0223.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0223.889] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2ac97 [0223.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0223.889] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0223.968] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0224.167] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0224.707] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0224.873] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0225.022] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2ac97, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2ac97, lpOverlapped=0x0) returned 1 [0225.040] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2ac97, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2ac97, lpOverlapped=0x0) returned 1 [0225.048] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.078] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.094] CloseHandle (hObject=0x1ec) returned 1 [0225.094] CloseHandle (hObject=0x1e8) returned 1 [0225.423] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.z49-css-qhb")) returned 0 [0225.424] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.z49-css-qhb")) returned 0x20 [0225.425] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fab0876, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2fab0876, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", cAlternateFileName="")) returned 0x7e2ac8 [0225.425] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fab0876, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2fab0876, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", cAlternateFileName="")) returned 0 [0225.425] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0225.425] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin")) returned 1 [0225.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin")) returned 0xffffffff [0225.429] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797bae0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3797bae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x379ee1a9, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x18ea5e4, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", cAlternateFileName="")) returned 1 [0225.430] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37149d8d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37149d8d, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3754fb0e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x6a1ab6c, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67", cAlternateFileName="")) returned 1 [0225.430] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x37575d5f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37575d5f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3771965f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x3b14000, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79", cAlternateFileName="")) returned 1 [0225.430] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x3771965f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3771965f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3773f8ba, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x529000, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37765b02, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37765b02, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37765b02, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x3cff18, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378e31c3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x378e31c3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3790940e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xcfdc43, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x3795589b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3795589b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3795589b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f38, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3792f650, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3792f650, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3792f650, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x1a3a61, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3795589b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3795589b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3795589b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x358f2f, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797bae0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3797bae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3797bae0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x5fff9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", cAlternateFileName="")) returned 1 [0225.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797bae0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3797bae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3797bae0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x441a1, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", cAlternateFileName="")) returned 1 [0225.432] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf915d5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xccf915d5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1ce7a3f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", cAlternateFileName="MPCACH~1.BIN")) returned 1 [0225.432] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0225.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0225.450] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2ac97 [0225.450] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0225.451] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0225.545] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0226.255] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0226.376] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0226.495] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0226.618] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2ac97, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2ac97, lpOverlapped=0x0) returned 1 [0226.629] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2ac97, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2ac97, lpOverlapped=0x0) returned 1 [0226.638] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.758] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.788] CloseHandle (hObject=0x1e8) returned 1 [0226.789] CloseHandle (hObject=0x1ec) returned 1 [0227.617] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.z49-css-qhb")) returned 0 [0227.620] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.z49-css-qhb")) returned 0x20 [0227.620] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf915d5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xccf915d5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1ce7a3f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", cAlternateFileName="MPCACH~1.BIN")) returned 0x7e2a48 [0227.620] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf915d5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xccf915d5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1ce7a3f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", cAlternateFileName="MPCACH~1.BIN")) returned 0 [0227.620] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0227.621] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin")) returned 1 [0227.623] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin")) returned 0xffffffff [0227.623] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18e1ad1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18e1ad1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1bb677b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x18ea5e4, dwReserved0=0xac, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", cAlternateFileName="MPCACH~1.5B")) returned 1 [0227.624] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1206ea7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1206ea7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd154e258, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x6a1ab6c, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67", cAlternateFileName="MPCACH~1.67")) returned 1 [0227.624] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd159a713, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd159a713, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd16592ea, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x3b14000, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79", cAlternateFileName="MPCACH~1.79")) returned 1 [0227.625] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd167f527, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd167f527, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd167f527, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x529000, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", cAlternateFileName="MPCACH~1.7C")) returned 1 [0227.656] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16cb9d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd16cb9d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd16cb9d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x3cff18, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", cAlternateFileName="MPCACH~1.7E")) returned 1 [0227.656] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1822efb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1822efb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd186f3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0xcfdc43, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", cAlternateFileName="MPCACH~1.80")) returned 1 [0227.656] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd18bb86e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18bb86e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18bb86e, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f38, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", cAlternateFileName="MPCACH~1.83")) returned 1 [0227.656] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1895623, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1895623, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1895623, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3a61, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", cAlternateFileName="MPCACH~1.87")) returned 1 [0227.656] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18bb86e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18bb86e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18bb86e, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x358f2f, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", cAlternateFileName="MPCACH~1.A0")) returned 1 [0227.657] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18e1ad1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18e1ad1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18e1ad1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x5fff9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", cAlternateFileName="MPCACH~1.CB")) returned 1 [0227.657] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18e1ad1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18e1ad1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18e1ad1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x441a1, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", cAlternateFileName="MPCACH~1.CC")) returned 1 [0227.657] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f57b34, ftCreationTime.dwHighDateTime=0x1d5e398, ftLastAccessTime.dwLowDateTime=0xf3f57b34, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xf53f0112, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.z49-css-qhb", cAlternateFileName="MPCACH~2.Z49")) returned 1 [0227.657] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="RtSigs", cAlternateFileName="")) returned 1 [0227.657] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0227.727] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.727] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0227.727] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0227.728] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="..", cAlternateFileName="")) returned 1 [0227.728] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="..", cAlternateFileName="")) returned 0 [0227.729] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0227.729] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0227.729] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0227.729] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="RtSigs", cAlternateFileName="")) returned 0 [0227.729] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0227.730] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="Support", cAlternateFileName="")) returned 1 [0227.730] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0227.730] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0227.730] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0227.730] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0227.731] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="Support", cAlternateFileName="")) returned 0 [0227.731] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0227.731] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726f70, dwReserved1=0x73656e69, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0227.731] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0227.732] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="..", cAlternateFileName="")) returned 1 [0227.732] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a9166d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="Cache", cAlternateFileName="")) returned 1 [0227.732] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x181, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0x61, dwReserved1=0x40221d, cFileName="", cAlternateFileName="H*~")) returned 0xffffffff [0227.733] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="Temp", cAlternateFileName="")) returned 1 [0227.733] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0227.733] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0227.734] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0227.734] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0227.734] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="Temp", cAlternateFileName="")) returned 0 [0227.734] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0227.734] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726570, dwReserved1=0x73656e69, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0227.734] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0227.735] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="..", cAlternateFileName="")) returned 1 [0227.735] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 1 [0227.735] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0227.738] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0227.738] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1231 [0227.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0227.739] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0227.889] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1231, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1231, lpOverlapped=0x0) returned 1 [0227.891] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1231, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1231, lpOverlapped=0x0) returned 1 [0227.893] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.927] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.943] CloseHandle (hObject=0x1f8) returned 1 [0227.944] CloseHandle (hObject=0x1ec) returned 1 [0227.947] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.z49-css-qhb")) returned 0 [0227.948] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.z49-css-qhb")) returned 0x20 [0227.948] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 0x7e2a88 [0227.948] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 0 [0227.948] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0227.949] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png")) returned 1 [0227.950] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png")) returned 0xffffffff [0227.950] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x65736769, dwReserved1=0x3743432d, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 0 [0227.951] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0227.951] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38346576, dwReserved1=0x2e383478, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0227.951] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0227.951] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0227.951] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x40221d, cFileName="MSFax", cAlternateFileName="")) returned 1 [0227.951] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0227.961] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.961] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0227.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0227.961] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0227.961] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0227.961] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0227.962] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0960f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0227.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0960f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0227.963] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0960f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0227.963] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="en-US", cAlternateFileName="")) returned 1 [0227.963] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0227.963] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0227.963] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0227.964] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0227.964] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x15c, dwReserved1=0x40221d, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0227.964] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x158, dwReserved1=0x40221d, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0227.964] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x158, dwReserved1=0x40221d, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0227.964] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0227.965] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="en-US", cAlternateFileName="")) returned 0 [0227.965] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0227.965] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1 [0227.965] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0227.966] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 1 [0227.966] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 0 [0227.966] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0227.967] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1 [0227.967] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0227.971] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 1 [0227.971] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 0 [0227.971] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0227.971] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="Queue_Migrated", cAlternateFileName="")) returned 1 [0227.971] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0227.992] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 1 [0227.992] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 0 [0227.992] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0227.992] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0227.992] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0227.993] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 1 [0227.993] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 0 [0227.993] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0227.993] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0227.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0227.993] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="..", cAlternateFileName="")) returned 1 [0227.993] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="en-US", cAlternateFileName="")) returned 1 [0227.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x158, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0227.994] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x158, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0227.994] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af00150, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x158, dwReserved1=0x40221d, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0227.994] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0227.996] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0227.996] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15dbe [0227.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0227.997] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0228.085] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x15dbe, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x15dbe, lpOverlapped=0x0) returned 1 [0228.114] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x15dbe, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x15dbe, lpOverlapped=0x0) returned 1 [0228.116] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.147] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.160] CloseHandle (hObject=0x1f4) returned 1 [0228.161] CloseHandle (hObject=0x1fc) returned 1 [0228.167] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.z49-css-qhb")) returned 0 [0228.167] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.z49-css-qhb")) returned 0x20 [0228.168] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af00150, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0x7e2bc8 [0228.168] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af00150, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0228.168] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0228.168] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0 [0228.169] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0x20 [0228.169] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af00150, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x158, dwReserved1=0x40221d, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0228.169] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0228.169] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x76766f63, cFileName="en-US", cAlternateFileName="")) returned 0 [0228.169] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0228.169] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0228.169] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0228.170] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c617574, dwReserved1=0x6f626e49, cFileName="MSScan", cAlternateFileName="")) returned 1 [0228.170] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0228.170] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5355, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.170] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x5355, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0228.171] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0228.201] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0228.203] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e148 [0228.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0228.203] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0228.314] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x7e148, lpOverlapped=0x0) returned 1 [0228.337] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7e148, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x7e148, lpOverlapped=0x0) returned 1 [0228.349] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.658] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.673] CloseHandle (hObject=0x1f8) returned 1 [0228.674] CloseHandle (hObject=0x1e8) returned 1 [0228.691] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.z49-css-qhb")) returned 0 [0228.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.z49-css-qhb")) returned 0x20 [0228.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0x7e2608 [0228.692] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0228.693] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0228.693] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0 [0228.703] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0228.703] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x5355, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0228.703] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0228.704] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c617574, dwReserved1=0x6f626e49, cFileName="MSScan", cAlternateFileName="")) returned 0 [0228.704] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0228.704] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x386e6163, dwReserved1=0x2e383478, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0228.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6f63, dwReserved1=0x6e616353, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0228.705] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6f63, dwReserved1=0x6e616353, cFileName="..", cAlternateFileName="")) returned 1 [0228.705] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6f63, dwReserved1=0x6e616353, cFileName="Health Advisor", cAlternateFileName="HEALTH~1")) returned 1 [0228.705] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0228.705] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0228.705] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0228.705] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0228.705] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6f63, dwReserved1=0x6e616353, cFileName="Logs", cAlternateFileName="")) returned 1 [0228.705] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0228.706] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0228.707] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bbd978f, ftCreationTime.dwHighDateTime=0x1d38c3f, ftLastAccessTime.dwLowDateTime=0x7bbd978f, ftLastAccessTime.dwHighDateTime=0x1d38c3f, ftLastWriteTime.dwLowDateTime=0x8d13fad9, ftLastWriteTime.dwHighDateTime=0x1d38c3f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~1.BIN")) returned 1 [0228.707] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0228.708] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0228.709] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0228.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0228.710] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0228.895] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0228.898] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0228.901] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.937] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.954] CloseHandle (hObject=0x1e8) returned 1 [0228.954] CloseHandle (hObject=0x1f8) returned 1 [0228.964] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0228.965] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0228.966] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bbd978f, ftCreationTime.dwHighDateTime=0x1d38c3f, ftLastAccessTime.dwLowDateTime=0x7bbd978f, ftLastAccessTime.dwHighDateTime=0x1d38c3f, ftLastWriteTime.dwLowDateTime=0x8d13fad9, ftLastWriteTime.dwHighDateTime=0x1d38c3f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~1.BIN")) returned 0x7e2ac8 [0228.966] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bbd978f, ftCreationTime.dwHighDateTime=0x1d38c3f, ftLastAccessTime.dwLowDateTime=0x7bbd978f, ftLastAccessTime.dwHighDateTime=0x1d38c3f, ftLastWriteTime.dwLowDateTime=0x8d13fad9, ftLastWriteTime.dwHighDateTime=0x1d38c3f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~1.BIN")) returned 0 [0228.966] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0228.966] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0228.968] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0228.968] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29ac15be, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x29ac15be, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x25d26abc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~2.BIN")) returned 1 [0228.968] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0228.969] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0228.969] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0228.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0228.970] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0229.059] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.071] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.073] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.105] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.121] CloseHandle (hObject=0x1f8) returned 1 [0229.121] CloseHandle (hObject=0x1e8) returned 1 [0229.123] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0229.124] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0229.124] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29ac15be, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x29ac15be, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x25d26abc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~2.BIN")) returned 0x7e26c8 [0229.124] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29ac15be, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x29ac15be, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x25d26abc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~2.BIN")) returned 0 [0229.124] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0229.125] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0229.126] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0229.126] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb863810c, ftCreationTime.dwHighDateTime=0x1d4ae7b, ftLastAccessTime.dwLowDateTime=0xb863810c, ftLastAccessTime.dwHighDateTime=0x1d4ae7b, ftLastWriteTime.dwLowDateTime=0x5a744dc7, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~3.BIN")) returned 1 [0229.127] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0229.127] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0229.128] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0229.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0229.128] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0229.219] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.221] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.223] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.253] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.268] CloseHandle (hObject=0x1e8) returned 1 [0229.268] CloseHandle (hObject=0x1f8) returned 1 [0229.271] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0229.272] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0229.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb863810c, ftCreationTime.dwHighDateTime=0x1d4ae7b, ftLastAccessTime.dwLowDateTime=0xb863810c, ftLastAccessTime.dwHighDateTime=0x1d4ae7b, ftLastWriteTime.dwLowDateTime=0x5a744dc7, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~3.BIN")) returned 0x7e2648 [0229.272] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb863810c, ftCreationTime.dwHighDateTime=0x1d4ae7b, ftLastAccessTime.dwLowDateTime=0xb863810c, ftLastAccessTime.dwHighDateTime=0x1d4ae7b, ftLastWriteTime.dwLowDateTime=0x5a744dc7, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~3.BIN")) returned 0 [0229.272] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0229.272] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0229.273] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0229.273] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x910999b0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x910999b0, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x583b1b7e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~4.BIN")) returned 1 [0229.274] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0229.274] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0229.275] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0229.275] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0229.275] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0229.362] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.366] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.367] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.398] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.410] CloseHandle (hObject=0x1f8) returned 1 [0229.411] CloseHandle (hObject=0x1e8) returned 1 [0229.414] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0229.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0229.417] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x910999b0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x910999b0, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x583b1b7e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~4.BIN")) returned 0x7e2648 [0229.417] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x910999b0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x910999b0, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x583b1b7e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~4.BIN")) returned 0 [0229.417] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0229.417] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0229.418] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081049-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0229.418] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8dd1d361, ftCreationTime.dwHighDateTime=0x1d5d806, ftLastAccessTime.dwLowDateTime=0x8dd1d361, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xd355e53a, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFEAC~1.BIN")) returned 1 [0229.419] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0229.419] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0229.420] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0229.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0229.420] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0229.595] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.597] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.599] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.625] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.639] CloseHandle (hObject=0x1e8) returned 1 [0229.640] CloseHandle (hObject=0x1f8) returned 1 [0229.643] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0229.644] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0229.644] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8dd1d361, ftCreationTime.dwHighDateTime=0x1d5d806, ftLastAccessTime.dwLowDateTime=0x8dd1d361, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xd355e53a, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFEAC~1.BIN")) returned 0x7e2c08 [0229.644] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8dd1d361, ftCreationTime.dwHighDateTime=0x1d5d806, ftLastAccessTime.dwLowDateTime=0x8dd1d361, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xd355e53a, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFEAC~1.BIN")) returned 0 [0229.644] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0229.644] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0229.646] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-081753-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0229.646] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x656a5b08, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0x656a5b08, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x909cf223, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH1574~1.BIN")) returned 1 [0229.646] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0229.647] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0229.647] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0229.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0229.648] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0229.727] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0229.729] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0229.730] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.755] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.767] CloseHandle (hObject=0x1f8) returned 1 [0229.767] CloseHandle (hObject=0x1e8) returned 1 [0229.769] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0229.770] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0229.770] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x656a5b08, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0x656a5b08, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x909cf223, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH1574~1.BIN")) returned 0x7e2848 [0229.770] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x656a5b08, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0x656a5b08, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x909cf223, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH1574~1.BIN")) returned 0 [0229.770] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0229.770] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0229.801] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-085233-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0229.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ab118, ftCreationTime.dwHighDateTime=0x1d5d80e, ftLastAccessTime.dwLowDateTime=0x4f6ab118, ftLastAccessTime.dwHighDateTime=0x1d5d80e, ftLastWriteTime.dwLowDateTime=0x57764536, ftLastWriteTime.dwHighDateTime=0x1d5d80f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCC9~1.BIN")) returned 1 [0229.802] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0229.886] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0229.887] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0229.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0229.888] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0229.976] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.978] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0229.979] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.012] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.027] CloseHandle (hObject=0x1e8) returned 1 [0230.027] CloseHandle (hObject=0x1f8) returned 1 [0230.057] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0230.058] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0230.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ab118, ftCreationTime.dwHighDateTime=0x1d5d80e, ftLastAccessTime.dwLowDateTime=0x4f6ab118, ftLastAccessTime.dwHighDateTime=0x1d5d80e, ftLastWriteTime.dwLowDateTime=0x57764536, ftLastWriteTime.dwHighDateTime=0x1d5d80f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCC9~1.BIN")) returned 0x7e2848 [0230.058] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ab118, ftCreationTime.dwHighDateTime=0x1d5d80e, ftLastAccessTime.dwLowDateTime=0x4f6ab118, ftLastAccessTime.dwHighDateTime=0x1d5d80e, ftLastWriteTime.dwLowDateTime=0x57764536, ftLastWriteTime.dwHighDateTime=0x1d5d80f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCC9~1.BIN")) returned 0 [0230.058] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0230.058] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0230.060] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-091325-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0230.060] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa767a579, ftCreationTime.dwHighDateTime=0x1d5d80f, ftLastAccessTime.dwLowDateTime=0xa767a579, ftLastAccessTime.dwHighDateTime=0x1d5d80f, ftLastWriteTime.dwLowDateTime=0x53135016, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH33AC~1.BIN")) returned 1 [0230.060] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0230.061] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0230.061] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0230.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0230.062] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0230.156] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0230.159] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0230.160] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.189] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.209] CloseHandle (hObject=0x1f8) returned 1 [0230.209] CloseHandle (hObject=0x1e8) returned 1 [0230.215] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0230.216] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0230.216] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa767a579, ftCreationTime.dwHighDateTime=0x1d5d80f, ftLastAccessTime.dwLowDateTime=0xa767a579, ftLastAccessTime.dwHighDateTime=0x1d5d80f, ftLastWriteTime.dwLowDateTime=0x53135016, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH33AC~1.BIN")) returned 0x7e2a88 [0230.216] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa767a579, ftCreationTime.dwHighDateTime=0x1d5d80f, ftLastAccessTime.dwLowDateTime=0xa767a579, ftLastAccessTime.dwHighDateTime=0x1d5d80f, ftLastWriteTime.dwLowDateTime=0x53135016, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH33AC~1.BIN")) returned 0 [0230.216] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0230.216] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0230.218] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-092302-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0230.218] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29cb790a, ftCreationTime.dwHighDateTime=0x1d5d815, ftLastAccessTime.dwLowDateTime=0x29cb790a, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHEC6E~1.BIN")) returned 1 [0230.218] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0230.218] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0230.219] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0230.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0230.219] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0230.300] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0230.304] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0230.305] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.330] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.356] CloseHandle (hObject=0x1e8) returned 1 [0230.357] CloseHandle (hObject=0x1f8) returned 1 [0230.359] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0230.360] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0230.360] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29cb790a, ftCreationTime.dwHighDateTime=0x1d5d815, ftLastAccessTime.dwLowDateTime=0x29cb790a, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHEC6E~1.BIN")) returned 0x7e2888 [0230.360] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29cb790a, ftCreationTime.dwHighDateTime=0x1d5d815, ftLastAccessTime.dwLowDateTime=0x29cb790a, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHEC6E~1.BIN")) returned 0 [0230.360] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0230.361] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0230.362] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100228-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0230.362] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xa1b0a55, ftCreationTime.dwHighDateTime=0x1d5d816, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH72C0~1.BIN")) returned 1 [0230.363] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.363] CloseHandle (hObject=0xffffffff) returned 1 [0230.363] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 1 [0230.365] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x2020 [0230.365] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x9, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x2e, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x39, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2e, nFileSizeLow=0x0, dwReserved0=0x7d4390, dwReserved1=0x0, cFileName="", cAlternateFileName="l!\x07\x02Ø/\x07\x02(2@")) returned 0xffffffff [0230.365] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x9, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x2e, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x39, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2e, nFileSizeLow=0x0, dwReserved0=0x7d4390, dwReserved1=0x0, cFileName="", cAlternateFileName="l!\x07\x02Ø/\x07\x02(2@")) returned 0 [0230.365] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0230.365] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs")) returned 0 [0230.365] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-01312020-100844-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0230.366] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf94c6396, ftCreationTime.dwHighDateTime=0x1d39f5a, ftLastAccessTime.dwLowDateTime=0xf94c6396, ftLastAccessTime.dwHighDateTime=0x1d39f5a, ftLastWriteTime.dwLowDateTime=0x54c48137, ftLastWriteTime.dwHighDateTime=0x1d39f5b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~1.BIN")) returned 1 [0230.366] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0230.367] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0230.367] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0230.368] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0230.368] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0230.525] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0230.542] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0230.544] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.575] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.595] CloseHandle (hObject=0x1f8) returned 1 [0230.595] CloseHandle (hObject=0x1e8) returned 1 [0230.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0230.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0230.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf94c6396, ftCreationTime.dwHighDateTime=0x1d39f5a, ftLastAccessTime.dwLowDateTime=0xf94c6396, ftLastAccessTime.dwHighDateTime=0x1d39f5a, ftLastWriteTime.dwLowDateTime=0x54c48137, ftLastWriteTime.dwHighDateTime=0x1d39f5b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~1.BIN")) returned 0x7e2848 [0230.599] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf94c6396, ftCreationTime.dwHighDateTime=0x1d39f5a, ftLastAccessTime.dwLowDateTime=0xf94c6396, ftLastAccessTime.dwHighDateTime=0x1d39f5a, ftLastWriteTime.dwLowDateTime=0x54c48137, ftLastWriteTime.dwHighDateTime=0x1d39f5b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~1.BIN")) returned 0 [0230.599] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0230.599] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0230.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0230.601] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb28f34a3, ftCreationTime.dwHighDateTime=0x1d39f5c, ftLastAccessTime.dwLowDateTime=0xb28f34a3, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xdd1442c1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~2.BIN")) returned 1 [0230.601] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0230.602] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0230.602] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0230.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0230.603] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0230.708] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0231.485] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0231.486] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.511] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.523] CloseHandle (hObject=0x1e8) returned 1 [0231.524] CloseHandle (hObject=0x1f8) returned 1 [0231.527] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0231.528] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0231.528] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb28f34a3, ftCreationTime.dwHighDateTime=0x1d39f5c, ftLastAccessTime.dwLowDateTime=0xb28f34a3, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xdd1442c1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~2.BIN")) returned 0x7e2b48 [0231.528] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb28f34a3, ftCreationTime.dwHighDateTime=0x1d39f5c, ftLastAccessTime.dwLowDateTime=0xb28f34a3, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xdd1442c1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~2.BIN")) returned 0 [0231.528] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0231.529] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0231.532] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0231.532] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee7ecabd, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0xee7ecabd, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x5e457d19, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~3.BIN")) returned 1 [0231.532] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0231.533] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0231.533] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0231.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0231.533] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0231.623] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0231.633] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0231.635] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.676] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.692] CloseHandle (hObject=0x1f8) returned 1 [0231.692] CloseHandle (hObject=0x1e8) returned 1 [0231.695] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0231.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0231.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee7ecabd, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0xee7ecabd, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x5e457d19, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~3.BIN")) returned 0x7e2888 [0231.696] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee7ecabd, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0xee7ecabd, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x5e457d19, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~3.BIN")) returned 0 [0231.696] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0231.696] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0231.698] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0231.698] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a075c31, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0x7a075c31, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x32313161, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~4.BIN")) returned 1 [0231.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0231.699] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0231.699] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0231.699] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0231.700] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0231.782] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0231.784] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0231.786] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.884] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.898] CloseHandle (hObject=0x1e8) returned 1 [0231.898] CloseHandle (hObject=0x1f8) returned 1 [0231.901] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0231.902] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0231.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a075c31, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0x7a075c31, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x32313161, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~4.BIN")) returned 0x7e2708 [0231.902] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a075c31, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0x7a075c31, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x32313161, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~4.BIN")) returned 0 [0231.902] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0231.902] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0231.903] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0231.904] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19a4d06c, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x19a4d06c, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x37122ed1, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~1.BIN")) returned 1 [0231.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0231.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0231.905] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0231.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0231.905] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0231.984] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0231.986] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0231.988] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.019] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.031] CloseHandle (hObject=0x1f8) returned 1 [0232.032] CloseHandle (hObject=0x1e8) returned 1 [0232.034] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0232.035] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0232.035] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19a4d06c, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x19a4d06c, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x37122ed1, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~1.BIN")) returned 0x7e2648 [0232.036] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19a4d06c, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x19a4d06c, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x37122ed1, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~1.BIN")) returned 0 [0232.036] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0232.036] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0232.037] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0232.038] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcadfed41, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xcadfed41, ftLastAccessTime.dwHighDateTime=0x1d4d5d2, ftLastWriteTime.dwLowDateTime=0xac415a8e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~2.BIN")) returned 1 [0232.038] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0232.039] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0232.040] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0232.040] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0232.041] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0232.127] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0232.132] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0232.133] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.166] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.180] CloseHandle (hObject=0x1e8) returned 1 [0232.181] CloseHandle (hObject=0x1f8) returned 1 [0232.183] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0232.183] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0232.184] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcadfed41, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xcadfed41, ftLastAccessTime.dwHighDateTime=0x1d4d5d2, ftLastWriteTime.dwLowDateTime=0xac415a8e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~2.BIN")) returned 0x7e2a48 [0232.184] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcadfed41, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xcadfed41, ftLastAccessTime.dwHighDateTime=0x1d4d5d2, ftLastWriteTime.dwLowDateTime=0xac415a8e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~2.BIN")) returned 0 [0232.184] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0232.184] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0232.186] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0232.186] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e95e484, ftCreationTime.dwHighDateTime=0x1d41dc3, ftLastAccessTime.dwLowDateTime=0x6e95e484, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0x6da4c73e, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~2.BIN")) returned 1 [0232.186] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0232.188] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0232.189] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0232.189] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0232.189] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0232.280] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0232.282] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0232.283] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.315] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.328] CloseHandle (hObject=0x1f8) returned 1 [0232.328] CloseHandle (hObject=0x1e8) returned 1 [0232.329] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0232.330] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0232.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e95e484, ftCreationTime.dwHighDateTime=0x1d41dc3, ftLastAccessTime.dwLowDateTime=0x6e95e484, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0x6da4c73e, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~2.BIN")) returned 0x7e2b08 [0232.331] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e95e484, ftCreationTime.dwHighDateTime=0x1d41dc3, ftLastAccessTime.dwLowDateTime=0x6e95e484, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0x6da4c73e, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~2.BIN")) returned 0 [0232.331] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0232.331] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0232.332] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0232.333] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3f8b81, ftCreationTime.dwHighDateTime=0x1d41dc5, ftLastAccessTime.dwLowDateTime=0xc3f8b81, ftLastAccessTime.dwHighDateTime=0x1d41dc5, ftLastWriteTime.dwLowDateTime=0x23c2da14, ftLastWriteTime.dwHighDateTime=0x1d41dc5, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~1.BIN")) returned 1 [0232.334] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0232.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0232.336] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0232.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0232.336] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0232.413] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0232.415] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0232.416] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.449] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.461] CloseHandle (hObject=0x1e8) returned 1 [0232.461] CloseHandle (hObject=0x1f8) returned 1 [0232.463] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0232.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0232.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3f8b81, ftCreationTime.dwHighDateTime=0x1d41dc5, ftLastAccessTime.dwLowDateTime=0xc3f8b81, ftLastAccessTime.dwHighDateTime=0x1d41dc5, ftLastWriteTime.dwLowDateTime=0x23c2da14, ftLastWriteTime.dwHighDateTime=0x1d41dc5, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~1.BIN")) returned 0x7e2548 [0232.464] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3f8b81, ftCreationTime.dwHighDateTime=0x1d41dc5, ftLastAccessTime.dwLowDateTime=0xc3f8b81, ftLastAccessTime.dwHighDateTime=0x1d41dc5, ftLastWriteTime.dwLowDateTime=0x23c2da14, ftLastWriteTime.dwHighDateTime=0x1d41dc5, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~1.BIN")) returned 0 [0232.464] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0232.465] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0232.466] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0232.466] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c78932, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x88c78932, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x7b55a971, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~1.BIN")) returned 1 [0232.467] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0232.467] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0232.468] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0232.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0232.468] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0232.665] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0232.688] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0232.690] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.742] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.757] CloseHandle (hObject=0x1f8) returned 1 [0232.758] CloseHandle (hObject=0x1e8) returned 1 [0232.759] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0232.760] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0232.760] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c78932, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x88c78932, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x7b55a971, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~1.BIN")) returned 0x7e2908 [0232.761] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c78932, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x88c78932, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x7b55a971, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~1.BIN")) returned 0 [0232.761] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0232.761] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0232.762] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0232.763] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9095a9c2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9095a9c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5a28d98a, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~2.BIN")) returned 1 [0232.763] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0232.764] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0232.764] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6000 [0232.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0232.765] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0232.913] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x6000, lpOverlapped=0x0) returned 1 [0232.917] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x6000, lpOverlapped=0x0) returned 1 [0232.919] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.950] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.967] CloseHandle (hObject=0x1e8) returned 1 [0232.967] CloseHandle (hObject=0x1f8) returned 1 [0232.971] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0232.973] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0232.973] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9095a9c2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9095a9c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5a28d98a, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~2.BIN")) returned 0x7e2848 [0232.973] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9095a9c2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9095a9c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5a28d98a, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~2.BIN")) returned 0 [0232.973] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0232.974] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0232.975] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0232.976] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64211155, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x64211155, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xfd42c56a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~3.BIN")) returned 1 [0232.976] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0232.977] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0232.978] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0232.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0232.979] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0233.069] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0233.071] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0233.072] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.106] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.121] CloseHandle (hObject=0x1f8) returned 1 [0233.121] CloseHandle (hObject=0x1e8) returned 1 [0233.127] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0233.128] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0233.128] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64211155, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x64211155, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xfd42c56a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~3.BIN")) returned 0x7e2648 [0233.129] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64211155, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x64211155, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xfd42c56a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~3.BIN")) returned 0 [0233.129] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0233.129] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0233.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0233.131] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65faa03, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x65faa03, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x8f6c25b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~4.BIN")) returned 1 [0233.132] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0233.132] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0233.133] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0233.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0233.133] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0233.220] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0233.222] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0233.224] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.276] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.291] CloseHandle (hObject=0x1e8) returned 1 [0233.292] CloseHandle (hObject=0x1f8) returned 1 [0233.293] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0233.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0233.295] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65faa03, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x65faa03, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x8f6c25b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~4.BIN")) returned 0x7e2bc8 [0233.295] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65faa03, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x65faa03, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x8f6c25b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~4.BIN")) returned 0 [0233.295] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0233.295] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0233.297] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0233.297] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x98d63d64, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x98d63d64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xffed8d7a, ftLastWriteTime.dwHighDateTime=0x1d327ec, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH3B08~1.BIN")) returned 1 [0233.297] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0233.298] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0233.298] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0233.298] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0233.299] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0233.389] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3000, lpOverlapped=0x0) returned 1 [0233.391] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3000, lpOverlapped=0x0) returned 1 [0233.393] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.416] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.431] CloseHandle (hObject=0x1f8) returned 1 [0233.432] CloseHandle (hObject=0x1e8) returned 1 [0233.433] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0233.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0233.434] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x98d63d64, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x98d63d64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xffed8d7a, ftLastWriteTime.dwHighDateTime=0x1d327ec, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH3B08~1.BIN")) returned 0x7e2a48 [0233.434] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x98d63d64, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x98d63d64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xffed8d7a, ftLastWriteTime.dwHighDateTime=0x1d327ec, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH3B08~1.BIN")) returned 0 [0233.434] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0233.435] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0233.436] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0233.436] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xd5f7bb1, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0xd5f7bb1, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xd5f7bb1, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH7EFA~1.BIN")) returned 1 [0233.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0233.437] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0233.437] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0233.437] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0233.438] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0233.578] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0233.581] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0233.582] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.607] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.619] CloseHandle (hObject=0x1e8) returned 1 [0233.619] CloseHandle (hObject=0x1f8) returned 1 [0233.621] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0233.622] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0233.622] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xd5f7bb1, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0xd5f7bb1, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xd5f7bb1, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH7EFA~1.BIN")) returned 0x7e26c8 [0233.622] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xd5f7bb1, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0xd5f7bb1, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xd5f7bb1, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH7EFA~1.BIN")) returned 0 [0233.622] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0233.622] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0233.623] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0233.623] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361892b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x8361892b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x1e89ead9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFD17~1.BIN")) returned 1 [0233.624] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0233.625] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0233.625] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0233.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0233.625] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0233.703] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0233.705] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0233.706] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.731] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.746] CloseHandle (hObject=0x1f8) returned 1 [0233.746] CloseHandle (hObject=0x1e8) returned 1 [0233.748] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0233.749] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0233.749] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361892b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x8361892b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x1e89ead9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFD17~1.BIN")) returned 0x7e2508 [0233.749] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361892b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x8361892b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x1e89ead9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFD17~1.BIN")) returned 0 [0233.749] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0233.749] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0233.751] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0233.751] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x291e9ee7, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x291e9ee7, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xbc53e837, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH8EDE~1.BIN")) returned 1 [0233.751] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0233.753] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0233.753] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0233.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0233.754] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0233.884] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0233.886] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0233.887] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.926] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.941] CloseHandle (hObject=0x1e8) returned 1 [0233.941] CloseHandle (hObject=0x1f8) returned 1 [0233.943] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0233.943] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0233.944] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x291e9ee7, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x291e9ee7, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xbc53e837, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH8EDE~1.BIN")) returned 0x7e2908 [0233.944] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x291e9ee7, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x291e9ee7, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xbc53e837, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH8EDE~1.BIN")) returned 0 [0233.944] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0233.944] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0233.946] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0233.946] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53a1f04, ftCreationTime.dwHighDateTime=0x1d461f2, ftLastAccessTime.dwLowDateTime=0xa53a1f04, ftLastAccessTime.dwHighDateTime=0x1d461f2, ftLastWriteTime.dwLowDateTime=0xc1465998, ftLastWriteTime.dwHighDateTime=0x1d461f2, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~2.BIN")) returned 1 [0233.946] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0233.947] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0233.949] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0233.949] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0233.950] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0234.041] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0234.046] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0234.047] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.078] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.095] CloseHandle (hObject=0x1f8) returned 1 [0234.096] CloseHandle (hObject=0x1e8) returned 1 [0234.097] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0234.098] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0234.098] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53a1f04, ftCreationTime.dwHighDateTime=0x1d461f2, ftLastAccessTime.dwLowDateTime=0xa53a1f04, ftLastAccessTime.dwHighDateTime=0x1d461f2, ftLastWriteTime.dwLowDateTime=0xc1465998, ftLastWriteTime.dwHighDateTime=0x1d461f2, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~2.BIN")) returned 0x7e2848 [0234.098] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53a1f04, ftCreationTime.dwHighDateTime=0x1d461f2, ftLastAccessTime.dwLowDateTime=0xa53a1f04, ftLastAccessTime.dwHighDateTime=0x1d461f2, ftLastWriteTime.dwLowDateTime=0xc1465998, ftLastWriteTime.dwHighDateTime=0x1d461f2, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~2.BIN")) returned 0 [0234.098] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0234.099] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0234.100] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0234.100] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24b95208, ftCreationTime.dwHighDateTime=0x1d461fa, ftLastAccessTime.dwLowDateTime=0x24b95208, ftLastAccessTime.dwHighDateTime=0x1d461fa, ftLastWriteTime.dwLowDateTime=0x41cd2745, ftLastWriteTime.dwHighDateTime=0x1d461fa, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~3.BIN")) returned 1 [0234.101] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0234.102] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0234.103] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0234.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0234.104] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0234.193] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0234.195] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0234.196] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.232] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.247] CloseHandle (hObject=0x1e8) returned 1 [0234.247] CloseHandle (hObject=0x1f8) returned 1 [0234.249] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0234.249] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0234.249] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24b95208, ftCreationTime.dwHighDateTime=0x1d461fa, ftLastAccessTime.dwLowDateTime=0x24b95208, ftLastAccessTime.dwHighDateTime=0x1d461fa, ftLastWriteTime.dwLowDateTime=0x41cd2745, ftLastWriteTime.dwHighDateTime=0x1d461fa, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~3.BIN")) returned 0x7e2a88 [0234.250] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24b95208, ftCreationTime.dwHighDateTime=0x1d461fa, ftLastAccessTime.dwLowDateTime=0x24b95208, ftLastAccessTime.dwHighDateTime=0x1d461fa, ftLastWriteTime.dwLowDateTime=0x41cd2745, ftLastWriteTime.dwHighDateTime=0x1d461fa, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~3.BIN")) returned 0 [0234.250] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0234.250] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0234.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0234.251] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8d5846d, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xb8d5846d, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd7cd567, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~1.BIN")) returned 1 [0234.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0234.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0234.252] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0234.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0234.253] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0234.341] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0234.343] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0234.344] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.398] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.428] CloseHandle (hObject=0x1f8) returned 1 [0234.428] CloseHandle (hObject=0x1e8) returned 1 [0234.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0234.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0234.449] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8d5846d, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xb8d5846d, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd7cd567, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~1.BIN")) returned 0x7e2688 [0234.449] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8d5846d, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xb8d5846d, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd7cd567, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~1.BIN")) returned 0 [0234.449] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0234.449] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0234.451] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0234.451] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e427524, ftCreationTime.dwHighDateTime=0x1d47c27, ftLastAccessTime.dwLowDateTime=0x4e427524, ftLastAccessTime.dwHighDateTime=0x1d47c27, ftLastWriteTime.dwLowDateTime=0x76bc81c5, ftLastWriteTime.dwHighDateTime=0x1d47c27, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~3.BIN")) returned 1 [0234.452] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0234.452] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0234.453] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0234.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0234.453] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0234.632] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0234.633] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0234.635] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.659] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.672] CloseHandle (hObject=0x1e8) returned 1 [0234.673] CloseHandle (hObject=0x1f8) returned 1 [0234.675] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0234.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0234.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e427524, ftCreationTime.dwHighDateTime=0x1d47c27, ftLastAccessTime.dwLowDateTime=0x4e427524, ftLastAccessTime.dwHighDateTime=0x1d47c27, ftLastWriteTime.dwLowDateTime=0x76bc81c5, ftLastWriteTime.dwHighDateTime=0x1d47c27, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~3.BIN")) returned 0x7e2848 [0234.676] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e427524, ftCreationTime.dwHighDateTime=0x1d47c27, ftLastAccessTime.dwLowDateTime=0x4e427524, ftLastAccessTime.dwHighDateTime=0x1d47c27, ftLastWriteTime.dwLowDateTime=0x76bc81c5, ftLastWriteTime.dwHighDateTime=0x1d47c27, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~3.BIN")) returned 0 [0234.676] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0234.676] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0234.677] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0234.677] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41355b6d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x41355b6d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x7313b7f3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~4.BIN")) returned 1 [0234.678] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0234.679] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0234.679] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0234.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0234.680] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0234.752] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0234.755] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0234.756] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.783] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.795] CloseHandle (hObject=0x1f8) returned 1 [0234.795] CloseHandle (hObject=0x1e8) returned 1 [0234.797] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0234.797] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0234.798] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41355b6d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x41355b6d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x7313b7f3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~4.BIN")) returned 0x7e2508 [0234.798] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41355b6d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x41355b6d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x7313b7f3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~4.BIN")) returned 0 [0234.798] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0234.798] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0234.799] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0234.801] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44ebf9e, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xc44ebf9e, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf7186f57, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCB7~1.BIN")) returned 1 [0234.801] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0234.802] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0234.802] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0234.802] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0234.803] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0234.947] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0234.949] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x2000, lpOverlapped=0x0) returned 1 [0234.951] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.982] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.002] CloseHandle (hObject=0x1e8) returned 1 [0235.004] CloseHandle (hObject=0x1f8) returned 1 [0235.011] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0235.012] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0235.012] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44ebf9e, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xc44ebf9e, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf7186f57, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCB7~1.BIN")) returned 0x7e2908 [0235.012] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44ebf9e, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xc44ebf9e, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf7186f57, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCB7~1.BIN")) returned 0 [0235.012] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0235.013] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0235.014] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0235.014] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x444f8b5f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x444f8b5f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x57b398d2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~1.BIN")) returned 1 [0235.015] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0235.015] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0235.016] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0235.016] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0235.016] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0235.104] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0235.106] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0235.108] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.139] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.153] CloseHandle (hObject=0x1f8) returned 1 [0235.154] CloseHandle (hObject=0x1e8) returned 1 [0235.155] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0235.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0235.156] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x444f8b5f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x444f8b5f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x57b398d2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~1.BIN")) returned 0x7e2a48 [0235.156] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x444f8b5f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x444f8b5f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x57b398d2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~1.BIN")) returned 0 [0235.157] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0235.157] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0235.158] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0235.158] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69870cf2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x69870cf2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x13731c69, ftLastWriteTime.dwHighDateTime=0x1d35e04, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~2.BIN")) returned 1 [0235.159] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0235.160] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0235.165] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0235.165] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0235.165] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0235.251] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0235.253] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x1000, lpOverlapped=0x0) returned 1 [0235.254] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.291] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.306] CloseHandle (hObject=0x1e8) returned 1 [0235.307] CloseHandle (hObject=0x1f8) returned 1 [0235.309] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0 [0235.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin.z49-css-qhb")) returned 0x20 [0235.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69870cf2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x69870cf2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x13731c69, ftLastWriteTime.dwHighDateTime=0x1d35e04, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~2.BIN")) returned 0x7e2848 [0235.311] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69870cf2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x69870cf2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x13731c69, ftLastWriteTime.dwHighDateTime=0x1d35e04, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~2.BIN")) returned 0 [0235.311] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0235.311] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 1 [0235.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin" (normalized: "c:\\users\\all users\\microsoft\\windows security health\\logs\\shs-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin")) returned 0xffffffff [0235.313] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69870cf2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x69870cf2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x13731c69, ftLastWriteTime.dwHighDateTime=0x1d35e04, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x50, dwReserved1=0x40221d, cFileName="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~2.BIN")) returned 0 [0235.313] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0235.313] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa1b0a55, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0xa1b0a55, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656d6f63, dwReserved1=0x6e616353, cFileName="Logs", cAlternateFileName="")) returned 0 [0235.313] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0235.313] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20687473, dwReserved1=0x69766441, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0235.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0235.317] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="..", cAlternateFileName="")) returned 1 [0235.317] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="Server", cAlternateFileName="")) returned 1 [0235.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0235.317] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0235.317] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0235.317] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0235.317] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="Server", cAlternateFileName="")) returned 0 [0235.317] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0235.318] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20726576, dwReserved1=0x69766441, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0235.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0235.318] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="..", cAlternateFileName="")) returned 1 [0235.318] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1 [0235.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0235.318] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0235.318] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0235.318] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0235.319] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="Profiles", cAlternateFileName="")) returned 1 [0235.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0235.319] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0235.319] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0235.319] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0235.319] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="Profiles", cAlternateFileName="")) returned 0 [0235.319] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0235.320] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20726576, dwReserved1=0x69766441, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0235.320] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0235.320] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6376536e, dwReserved1=0x63655343, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0235.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x69736573, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0235.321] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x69736573, cFileName="..", cAlternateFileName="")) returned 1 [0235.321] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x69736573, cFileName="setup", cAlternateFileName="")) returned 1 [0235.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0235.321] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="..", cAlternateFileName="")) returned 1 [0235.321] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0235.322] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0235.322] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0235.324] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0235.324] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0235.324] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0235.417] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x0, lpOverlapped=0x0) returned 1 [0235.417] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.449] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.464] CloseHandle (hObject=0x1ec) returned 1 [0235.464] CloseHandle (hObject=0x1f8) returned 1 [0235.465] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.z49-css-qhb")) returned 0 [0235.465] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.z49-css-qhb" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.z49-css-qhb")) returned 0x2020 [0235.466] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="refcount.ini", cAlternateFileName="")) returned 0x7e2a08 [0235.466] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0235.466] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0235.466] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 1 [0235.466] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 0xffffffff [0235.467] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3131312d, dwReserved1=0x31303235, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0235.467] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0235.467] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x69736573, cFileName="setup", cAlternateFileName="")) returned 0 [0235.467] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0235.467] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63767075, dwReserved1=0x63655343, cFileName="Oracle", cAlternateFileName="")) returned 1 [0235.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e756f63, dwReserved1=0x6e692e74, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0235.467] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e756f63, dwReserved1=0x6e692e74, cFileName="..", cAlternateFileName="")) returned 1 [0235.468] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e756f63, dwReserved1=0x6e692e74, cFileName="Java", cAlternateFileName="")) returned 1 [0235.468] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0235.469] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0235.469] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0235.469] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0235.470] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0235.470] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1 [0235.470] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 0 [0235.471] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0235.471] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x39326366, dwReserved1=0x31393932, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0235.471] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0235.484] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0235.484] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x1f8, dwReserved1=0x40221d, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0235.484] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0235.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0235.486] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4eba475 [0235.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0235.487] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0235.640] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0236.452] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0236.608] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0237.191] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0237.315] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0238.910] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0239.112] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0239.328] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0239.516] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0239.695] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0239.847] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0240.125] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0240.265] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0240.455] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0240.618] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0240.808] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0241.004] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0241.142] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0241.263] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0241.527] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0241.679] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0241.930] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0242.058] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0242.224] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0242.333] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0243.132] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0243.305] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0243.479] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0243.641] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0243.772] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x500000, lpOverlapped=0x0) returned 1 [0243.961] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3ba475, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x3ba475, lpOverlapped=0x0) returned 1 [0244.044] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3ba475, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x3ba475, lpOverlapped=0x0) returned 1 [0244.141] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.165] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.177] CloseHandle (hObject=0x1ec) returned 1 [0244.178] CloseHandle (hObject=0x1e8) returned 1 [0244.579] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.581] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.581] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0x7e2508 [0244.581] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0 [0244.581] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0244.581] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 1 [0244.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.598] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.598] CloseHandle (hObject=0xffffffff) returned 1 [0244.598] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.599] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="|-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.599] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.599] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.599] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.599] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.600] CloseHandle (hObject=0xffffffff) returned 1 [0244.600] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.600] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.600] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.600] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.601] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.601] CloseHandle (hObject=0xffffffff) returned 1 [0244.601] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.601] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.601] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.602] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.602] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.602] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.602] CloseHandle (hObject=0xffffffff) returned 1 [0244.602] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.602] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¬-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.603] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¬-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.603] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.603] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.603] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.603] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.603] CloseHandle (hObject=0xffffffff) returned 1 [0244.603] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.603] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.603] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.604] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¼-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.604] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.604] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.604] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.604] CloseHandle (hObject=0xffffffff) returned 1 [0244.604] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.604] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.605] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.605] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ì-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.605] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.605] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.605] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.605] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.605] CloseHandle (hObject=0xffffffff) returned 1 [0244.605] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.606] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ü-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.606] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.606] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.606] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.606] CloseHandle (hObject=0xffffffff) returned 1 [0244.606] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.607] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.607] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.607] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.607] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.607] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.607] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.607] CloseHandle (hObject=0xffffffff) returned 1 [0244.608] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.608] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.608] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.608] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü-\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.608] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.608] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.608] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.609] CloseHandle (hObject=0xffffffff) returned 1 [0244.609] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.609] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.609] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.609] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c.\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.609] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.609] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.609] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.609] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.610] CloseHandle (hObject=0xffffffff) returned 1 [0244.610] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.610] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.610] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x1c.\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.610] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x1c.\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.610] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.610] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.610] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.611] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.611] CloseHandle (hObject=0xffffffff) returned 1 [0244.611] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.611] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.611] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=",.\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.611] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=",.\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.611] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.611] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.612] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.612] CloseHandle (hObject=0xffffffff) returned 1 [0244.612] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.612] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="<.\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.612] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="<.\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.612] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.612] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.613] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.613] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.613] CloseHandle (hObject=0xffffffff) returned 1 [0244.613] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.613] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.613] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="L.\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.613] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="L.\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.613] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.614] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.614] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.614] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.614] CloseHandle (hObject=0xffffffff) returned 1 [0244.614] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0 [0244.614] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.z49-css-qhb")) returned 0x2020 [0244.614] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\\.\x07\x02\x04-\x07\x02(2@")) returned 0xffffffff [0244.614] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\\.\x07\x02\x04-\x07\x02(2@")) returned 0 [0244.615] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0244.615] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64")) returned 0 [0244.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0xffffffff [0244.615] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x1f8, dwReserved1=0x40221d, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0 [0244.615] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0244.615] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61666567, cFileName="javapath", cAlternateFileName="")) returned 1 [0244.615] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0244.615] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0244.616] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="java.exe", cAlternateFileName="")) returned 1 [0244.616] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0244.616] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0244.659] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32840 [0244.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0244.660] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0244.757] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x32840, lpOverlapped=0x0) returned 1 [0244.844] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x32840, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x32840, lpOverlapped=0x0) returned 1 [0244.849] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.881] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.901] CloseHandle (hObject=0x1e8) returned 1 [0244.901] CloseHandle (hObject=0x1ec) returned 1 [0244.911] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.z49-css-qhb")) returned 0 [0244.912] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.z49-css-qhb")) returned 0x2020 [0244.912] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="java.exe", cAlternateFileName="")) returned 0x7e2848 [0244.913] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="java.exe", cAlternateFileName="")) returned 0 [0244.913] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0244.913] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe")) returned 1 [0244.916] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe")) returned 0xffffffff [0244.916] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0244.917] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0244.917] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0244.918] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32840 [0244.918] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0244.919] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0245.112] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x32840, lpOverlapped=0x0) returned 1 [0245.229] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x32840, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x32840, lpOverlapped=0x0) returned 1 [0245.266] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.440] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.455] CloseHandle (hObject=0x1ec) returned 1 [0245.456] CloseHandle (hObject=0x1e8) returned 1 [0245.483] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.z49-css-qhb")) returned 0 [0245.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.z49-css-qhb")) returned 0x2020 [0245.495] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="javaw.exe", cAlternateFileName="")) returned 0x7e2ac8 [0245.495] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="javaw.exe", cAlternateFileName="")) returned 0 [0245.495] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0245.496] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe")) returned 1 [0245.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe")) returned 0xffffffff [0245.499] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0245.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0245.500] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0245.500] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e040 [0245.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0245.501] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0245.719] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4e040, lpNumberOfBytesRead=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ee14*=0x4e040, lpOverlapped=0x0) returned 1 [0245.755] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4e040, lpNumberOfBytesWritten=0x19ee14, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ee14*=0x4e040, lpOverlapped=0x0) returned 1 [0245.801] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.880] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.893] CloseHandle (hObject=0x1e8) returned 1 [0245.894] CloseHandle (hObject=0x1ec) returned 1 [0245.938] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe.z49-css-qhb")) returned 0 [0245.939] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe.z49-css-qhb")) returned 0x2020 [0245.939] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="javaws.exe", cAlternateFileName="")) returned 0x7e2648 [0245.940] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19ed10 | out: lpFindFileData=0x19ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x7d85a0, dwReserved1=0x7ec0f0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0245.940] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0245.940] DeleteFileA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe")) returned 1 [0245.945] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe")) returned 0xffffffff [0245.945] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0245.945] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0245.946] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e737761, dwReserved1=0x61657865, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0245.946] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2c76af, ftLastAccessTime.dwHighDateTime=0x1d5e399, ftLastWriteTime.dwLowDateTime=0x2c76af, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0245.946] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2c76af, ftLastAccessTime.dwHighDateTime=0x1d5e399, ftLastWriteTime.dwLowDateTime=0x2c76af, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0245.946] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff61134d, ftCreationTime.dwHighDateTime=0x1d5e398, ftLastAccessTime.dwLowDateTime=0xff61134d, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xff8def5c, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="java.exe.z49-css-qhb", cAlternateFileName="JAVAEX~1.Z49")) returned 1 [0245.947] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff9052ab, ftCreationTime.dwHighDateTime=0x1d5e398, ftLastAccessTime.dwLowDateTime=0xff9052ab, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xffe6b95c, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="javaw.exe.z49-css-qhb", cAlternateFileName="JAVAWE~1.Z49")) returned 1 [0245.947] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xffe8e0da, ftCreationTime.dwHighDateTime=0x1d5e398, ftLastAccessTime.dwLowDateTime=0xffe8e0da, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0x2c76af, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="javaws.exe.z49-css-qhb", cAlternateFileName="JAVAWS~1.Z49")) returned 1 [0245.947] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xffe8e0da, ftCreationTime.dwHighDateTime=0x1d5e398, ftLastAccessTime.dwLowDateTime=0xffe8e0da, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0x2c76af, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="javaws.exe.z49-css-qhb", cAlternateFileName="JAVAWS~1.Z49")) returned 0 [0245.947] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0245.947] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e737761, dwReserved1=0x61657865, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0245.947] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0245.948] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e756f63, dwReserved1=0x6e692e74, cFileName="Java", cAlternateFileName="")) returned 0 [0245.948] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0245.948] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63767061, dwReserved1=0x63655343, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0245.948] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617061, dwReserved1=0x61745f68, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0245.949] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617061, dwReserved1=0x61745f68, cFileName="..", cAlternateFileName="")) returned 1 [0245.949] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617061, dwReserved1=0x61745f68, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0245.950] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e737761, dwReserved1=0x2e657865, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0245.951] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e737761, dwReserved1=0x2e657865, cFileName="..", cAlternateFileName="")) returned 1 [0245.951] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e737761, dwReserved1=0x2e657865, cFileName="packages", cAlternateFileName="")) returned 1 [0245.951] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0245.952] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.952] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0245.952] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0245.953] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0245.953] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0245.953] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0245.954] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0246.029] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf36be [0246.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0246.029] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0246.204] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xf36be, lpOverlapped=0x0) returned 1 [0246.290] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xf36be, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xf36be, lpOverlapped=0x0) returned 1 [0246.424] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.470] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.521] CloseHandle (hObject=0x1e8) returned 1 [0246.521] CloseHandle (hObject=0x1fc) returned 1 [0246.694] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb")) returned 0 [0246.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb")) returned 0x20 [0246.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2848 [0246.707] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0246.707] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0246.708] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0246.746] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0246.746] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x4c, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0246.747] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0246.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0246.767] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0246.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0246.767] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0246.872] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0246.928] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0246.932] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.959] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.974] CloseHandle (hObject=0x1fc) returned 1 [0246.974] CloseHandle (hObject=0x1e8) returned 1 [0246.980] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb")) returned 0 [0246.981] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb")) returned 0x20 [0246.981] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2848 [0246.982] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0246.982] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0246.982] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0246.985] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0246.985] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x4c, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0246.985] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0246.985] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0246.985] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0246.986] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e737761, dwReserved1=0x2e657865, cFileName="packages", cAlternateFileName="")) returned 0 [0246.986] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0246.986] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x61745f73, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0246.986] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0246.986] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="..", cAlternateFileName="")) returned 1 [0246.987] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0246.987] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0246.987] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0246.988] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0246.990] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f428 [0246.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0246.991] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0247.079] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6f428, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x6f428, lpOverlapped=0x0) returned 1 [0247.133] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6f428, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x6f428, lpOverlapped=0x0) returned 1 [0247.144] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.177] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.192] CloseHandle (hObject=0x1f8) returned 1 [0247.193] CloseHandle (hObject=0x1ec) returned 1 [0247.212] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.z49-css-qhb")) returned 0 [0247.220] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.z49-css-qhb")) returned 0x20 [0247.221] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x7e2a08 [0247.221] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0247.221] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0247.222] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe")) returned 1 [0247.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe")) returned 0xffffffff [0247.228] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0247.229] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0247.229] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73696465, dwReserved1=0x38785f74, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0247.229] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0247.232] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0247.232] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 1 [0247.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0247.233] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.233] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0247.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0247.234] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0247.234] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0247.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0247.235] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0247.252] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x588124 [0247.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0247.253] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0247.633] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0248.028] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0248.201] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x88124, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x88124, lpOverlapped=0x0) returned 1 [0248.231] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x88124, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x88124, lpOverlapped=0x0) returned 1 [0248.248] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.281] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.295] CloseHandle (hObject=0x1e8) returned 1 [0248.295] CloseHandle (hObject=0x1fc) returned 1 [0248.514] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb")) returned 0 [0248.516] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb")) returned 0x20 [0248.516] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2c08 [0248.516] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0248.516] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0248.517] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0248.525] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0248.525] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x1004, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0248.526] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0248.529] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0248.530] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0248.530] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0248.530] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0248.642] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0248.647] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0248.652] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.932] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.948] CloseHandle (hObject=0x1fc) returned 1 [0248.948] CloseHandle (hObject=0x1e8) returned 1 [0248.959] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb")) returned 0 [0248.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb")) returned 0x20 [0248.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2bc8 [0248.961] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0248.961] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0248.961] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0248.964] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0248.964] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x1004, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0248.971] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0248.972] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0248.972] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0248.972] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 0 [0248.972] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0248.972] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x38785f73, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0248.973] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0248.973] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="..", cAlternateFileName="")) returned 1 [0248.973] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0248.974] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0248.974] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0248.974] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0248.978] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x710a8 [0248.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0248.979] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0249.105] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x710a8, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x710a8, lpOverlapped=0x0) returned 1 [0249.117] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x710a8, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x710a8, lpOverlapped=0x0) returned 1 [0249.132] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.164] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.185] CloseHandle (hObject=0x1ec) returned 1 [0249.185] CloseHandle (hObject=0x1f8) returned 1 [0249.198] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.z49-css-qhb")) returned 0 [0249.199] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.z49-css-qhb")) returned 0x20 [0249.200] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x7e2a08 [0249.200] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0249.200] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0249.201] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe")) returned 1 [0249.206] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe")) returned 0xffffffff [0249.206] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0249.207] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0249.207] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73696465, dwReserved1=0x36785f74, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0249.207] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0249.210] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0249.210] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 1 [0249.210] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0249.211] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.211] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0249.211] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0249.211] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0249.211] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0249.212] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0249.213] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0249.215] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13babb [0249.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0249.216] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0249.308] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x13babb, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x13babb, lpOverlapped=0x0) returned 1 [0249.352] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x13babb, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x13babb, lpOverlapped=0x0) returned 1 [0249.385] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.419] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.441] CloseHandle (hObject=0x1e8) returned 1 [0249.442] CloseHandle (hObject=0x1fc) returned 1 [0249.493] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb")) returned 0 [0249.494] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb")) returned 0x20 [0249.495] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2c48 [0249.495] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0249.495] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0249.501] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0249.504] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0249.505] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0249.506] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0249.508] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0249.509] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24000 [0249.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0249.509] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0249.622] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x24000, lpOverlapped=0x0) returned 1 [0249.627] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x24000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x24000, lpOverlapped=0x0) returned 1 [0249.631] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.663] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.678] CloseHandle (hObject=0x1fc) returned 1 [0249.678] CloseHandle (hObject=0x1e8) returned 1 [0249.688] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb")) returned 0 [0249.690] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb")) returned 0x20 [0249.690] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2888 [0249.690] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0249.690] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0249.690] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0249.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0249.693] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x28, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0249.693] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0249.693] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0249.693] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0249.694] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 0 [0249.694] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0249.694] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0249.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0249.695] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="..", cAlternateFileName="")) returned 1 [0249.695] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 1 [0249.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0249.695] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="..", cAlternateFileName="")) returned 1 [0249.695] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0249.696] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0249.696] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0249.696] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0249.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0249.697] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0249.699] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f699e [0249.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0249.700] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0249.892] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4f699e, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x4f699e, lpOverlapped=0x0) returned 1 [0250.089] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4f699e, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x4f699e, lpOverlapped=0x0) returned 1 [0250.214] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.243] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.256] CloseHandle (hObject=0x1e8) returned 1 [0250.256] CloseHandle (hObject=0x1fc) returned 1 [0250.372] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb")) returned 0 [0250.374] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb")) returned 0x20 [0250.374] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2608 [0250.374] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0250.374] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0250.375] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0250.386] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0250.386] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0250.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0250.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0250.388] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0250.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0250.388] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0250.517] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0250.522] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0250.526] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.562] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.591] CloseHandle (hObject=0x1fc) returned 1 [0250.592] CloseHandle (hObject=0x1e8) returned 1 [0250.593] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb")) returned 0 [0250.594] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb")) returned 0x20 [0250.594] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2648 [0250.594] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0250.594] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0250.595] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0250.597] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0250.597] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0250.597] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0250.598] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0250.598] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0250.598] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 0 [0250.598] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0250.598] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0250.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0250.602] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="..", cAlternateFileName="")) returned 1 [0250.602] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="packages", cAlternateFileName="")) returned 1 [0250.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0250.603] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="..", cAlternateFileName="")) returned 1 [0250.603] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0250.603] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0250.604] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0250.604] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0250.604] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0250.605] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0250.609] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x165257 [0250.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0250.610] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0250.718] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x165257, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x165257, lpOverlapped=0x0) returned 1 [0250.804] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x165257, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x165257, lpOverlapped=0x0) returned 1 [0250.853] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.905] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.926] CloseHandle (hObject=0x1e8) returned 1 [0250.926] CloseHandle (hObject=0x1fc) returned 1 [0250.927] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb")) returned 0 [0250.928] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb")) returned 0x20 [0250.928] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2c48 [0250.928] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0250.928] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0250.929] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0250.936] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0250.936] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x8c8, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0251.056] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0251.057] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0251.058] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24000 [0251.059] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0251.059] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0251.232] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x24000, lpOverlapped=0x0) returned 1 [0251.246] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x24000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x24000, lpOverlapped=0x0) returned 1 [0251.251] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.291] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.307] CloseHandle (hObject=0x1fc) returned 1 [0251.308] CloseHandle (hObject=0x1e8) returned 1 [0251.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb")) returned 0 [0251.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb")) returned 0x20 [0251.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2b08 [0251.310] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0251.310] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0251.310] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0251.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0251.313] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x8c8, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0251.314] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0251.314] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0251.314] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0251.314] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="packages", cAlternateFileName="")) returned 0 [0251.314] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0251.314] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0251.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0251.315] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="..", cAlternateFileName="")) returned 1 [0251.315] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 1 [0251.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0251.316] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="..", cAlternateFileName="")) returned 1 [0251.316] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0251.316] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0251.316] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0251.316] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0251.317] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0251.318] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0251.321] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554520 [0251.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0251.321] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0251.419] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0251.618] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0251.781] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x54520, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x54520, lpOverlapped=0x0) returned 1 [0251.796] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x54520, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x54520, lpOverlapped=0x0) returned 1 [0251.808] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.840] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.855] CloseHandle (hObject=0x1e8) returned 1 [0251.855] CloseHandle (hObject=0x1fc) returned 1 [0251.856] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb")) returned 0 [0251.857] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb")) returned 0x20 [0251.857] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2688 [0251.857] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0251.857] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0251.858] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0251.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0251.890] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0251.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0251.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0251.894] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0251.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0251.894] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0252.084] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0252.089] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0252.093] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.141] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.157] CloseHandle (hObject=0x1fc) returned 1 [0252.158] CloseHandle (hObject=0x1e8) returned 1 [0252.159] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb")) returned 0 [0252.160] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb")) returned 0x20 [0252.160] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2a88 [0252.161] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0252.161] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0252.161] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0252.164] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0252.164] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0252.164] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0252.164] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0252.165] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0252.165] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 0 [0252.165] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0252.165] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0252.165] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0252.166] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="..", cAlternateFileName="")) returned 1 [0252.166] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="packages", cAlternateFileName="")) returned 1 [0252.166] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0252.167] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="..", cAlternateFileName="")) returned 1 [0252.167] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0252.167] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0252.168] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0252.168] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0252.168] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0252.169] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0252.175] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc90a [0252.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0252.175] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0252.265] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xfc90a, lpOverlapped=0x0) returned 1 [0252.418] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xfc90a, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xfc90a, lpOverlapped=0x0) returned 1 [0252.516] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.547] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.563] CloseHandle (hObject=0x1e8) returned 1 [0252.563] CloseHandle (hObject=0x1fc) returned 1 [0252.564] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb")) returned 0 [0252.565] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb")) returned 0x20 [0252.565] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2b48 [0252.565] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0252.565] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0252.566] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0252.577] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0252.577] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0252.578] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0252.594] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0252.595] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0252.595] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0252.595] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0252.688] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0252.699] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0252.703] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.736] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.751] CloseHandle (hObject=0x1fc) returned 1 [0252.751] CloseHandle (hObject=0x1e8) returned 1 [0252.752] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb")) returned 0 [0252.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb")) returned 0x20 [0252.753] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2888 [0252.753] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0252.754] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0252.754] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0252.756] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0252.756] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0252.757] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0252.757] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0252.757] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0252.757] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="packages", cAlternateFileName="")) returned 0 [0252.757] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0252.757] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0252.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0252.758] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="..", cAlternateFileName="")) returned 1 [0252.759] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 1 [0252.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0252.759] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="..", cAlternateFileName="")) returned 1 [0252.759] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0252.759] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0252.760] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0252.760] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0252.761] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0252.762] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0252.764] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ea418 [0252.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0252.764] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0252.912] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x4ea418, lpOverlapped=0x0) returned 1 [0253.883] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4ea418, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x4ea418, lpOverlapped=0x0) returned 1 [0254.082] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.117] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.132] CloseHandle (hObject=0x1e8) returned 1 [0254.132] CloseHandle (hObject=0x1fc) returned 1 [0254.133] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb")) returned 0 [0254.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb")) returned 0x20 [0254.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2908 [0254.141] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0254.142] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0254.142] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0254.154] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0254.154] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x8dc, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0254.155] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0254.156] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0254.157] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0254.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0254.158] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0254.262] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0254.269] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0254.274] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.312] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.329] CloseHandle (hObject=0x1fc) returned 1 [0254.330] CloseHandle (hObject=0x1e8) returned 1 [0254.331] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb")) returned 0 [0254.332] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb")) returned 0x20 [0254.332] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2848 [0254.332] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0254.332] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0254.332] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0254.335] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0254.335] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x8dc, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0254.335] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0254.336] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0254.336] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0254.336] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 0 [0254.336] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0254.336] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0254.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0254.337] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="..", cAlternateFileName="")) returned 1 [0254.337] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="packages", cAlternateFileName="")) returned 1 [0254.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0254.337] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="..", cAlternateFileName="")) returned 1 [0254.337] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0254.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0254.338] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0254.338] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0254.339] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0254.339] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0254.406] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc89b1 [0254.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0254.406] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0254.489] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xc89b1, lpOverlapped=0x0) returned 1 [0254.600] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc89b1, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xc89b1, lpOverlapped=0x0) returned 1 [0254.615] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.662] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.675] CloseHandle (hObject=0x1e8) returned 1 [0254.676] CloseHandle (hObject=0x1fc) returned 1 [0254.676] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb")) returned 0 [0254.677] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.z49-css-qhb")) returned 0x20 [0254.677] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2c88 [0254.678] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0254.678] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0254.678] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0254.690] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0254.690] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x100c, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0254.691] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0254.691] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0254.691] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0254.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0254.692] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0254.859] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0255.102] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0255.106] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.137] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.150] CloseHandle (hObject=0x1fc) returned 1 [0255.151] CloseHandle (hObject=0x1e8) returned 1 [0255.151] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb")) returned 0 [0255.152] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.z49-css-qhb")) returned 0x20 [0255.153] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2b08 [0255.153] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0255.153] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0255.153] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0255.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0255.155] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x100c, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0255.155] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0255.156] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x41656d69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0255.156] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0255.156] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="packages", cAlternateFileName="")) returned 0 [0255.156] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0255.156] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0255.156] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0255.157] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="..", cAlternateFileName="")) returned 1 [0255.157] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0255.157] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0255.157] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0255.158] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0255.167] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f398 [0255.167] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0255.167] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0255.245] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x6f398, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x6f398, lpOverlapped=0x0) returned 1 [0255.254] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x6f398, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x6f398, lpOverlapped=0x0) returned 1 [0255.264] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.293] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.307] CloseHandle (hObject=0x1f8) returned 1 [0255.308] CloseHandle (hObject=0x1ec) returned 1 [0255.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.z49-css-qhb")) returned 0 [0255.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.z49-css-qhb")) returned 0x20 [0255.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x7e2a88 [0255.309] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0255.309] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0255.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe")) returned 1 [0255.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe")) returned 0xffffffff [0255.314] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0255.314] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0255.314] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73696465, dwReserved1=0x36785f74, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0255.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8f4, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0255.314] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8f4, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0255.314] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8f4, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 1 [0255.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0255.315] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.315] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0255.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0255.315] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0255.315] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0255.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0255.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0255.328] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5b25 [0255.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0255.329] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0255.421] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0xc5b25, lpOverlapped=0x0) returned 1 [0255.466] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xc5b25, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0xc5b25, lpOverlapped=0x0) returned 1 [0255.485] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.515] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.529] CloseHandle (hObject=0x1e8) returned 1 [0255.530] CloseHandle (hObject=0x1fc) returned 1 [0255.530] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb")) returned 0 [0255.531] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.z49-css-qhb")) returned 0x20 [0255.531] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2a88 [0255.532] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0255.532] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0255.532] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0255.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0255.540] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0255.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0255.541] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0255.543] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0255.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0255.543] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0255.651] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0255.657] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x25000, lpOverlapped=0x0) returned 1 [0255.661] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.696] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.713] CloseHandle (hObject=0x1fc) returned 1 [0255.713] CloseHandle (hObject=0x1e8) returned 1 [0255.714] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb")) returned 0 [0255.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.z49-css-qhb")) returned 0x20 [0255.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2a88 [0255.716] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0255.716] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0255.717] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0255.719] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0255.719] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0255.720] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0255.720] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0255.720] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0255.720] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8f4, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 0 [0255.720] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0255.721] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0255.721] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0255.721] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="..", cAlternateFileName="")) returned 1 [0255.721] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 1 [0255.721] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0255.721] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="..", cAlternateFileName="")) returned 1 [0255.722] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0255.726] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0255.727] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0255.728] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0255.728] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0255.729] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0255.732] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59bde5 [0255.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0255.733] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0256.013] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0256.308] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x500000, lpOverlapped=0x0) returned 1 [0256.461] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x9bde5, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x9bde5, lpOverlapped=0x0) returned 1 [0256.481] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x9bde5, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x9bde5, lpOverlapped=0x0) returned 1 [0256.501] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.532] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.545] CloseHandle (hObject=0x1e8) returned 1 [0256.545] CloseHandle (hObject=0x1fc) returned 1 [0256.546] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb")) returned 0 [0256.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.z49-css-qhb")) returned 0x20 [0256.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e26c8 [0256.547] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0256.547] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0256.548] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0256.558] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0256.558] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0256.559] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0256.559] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0256.560] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0256.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0256.560] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0256.669] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0256.674] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0256.679] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.713] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.729] CloseHandle (hObject=0x1fc) returned 1 [0256.729] CloseHandle (hObject=0x1e8) returned 1 [0256.730] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb")) returned 0 [0256.731] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.z49-css-qhb")) returned 0x20 [0256.731] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2ac8 [0256.731] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0256.731] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0256.732] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0256.734] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0256.735] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0256.735] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0256.735] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e7572, dwReserved1=0x4d656d69, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0256.735] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0256.735] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x694d656d, cFileName="packages", cAlternateFileName="")) returned 0 [0256.735] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0256.758] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x36785f73, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0256.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0256.759] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="..", cAlternateFileName="")) returned 1 [0256.759] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0256.759] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0256.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0256.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0256.762] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbee38 [0256.762] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0256.763] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0256.864] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0xbee38, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0xbee38, lpOverlapped=0x0) returned 1 [0256.880] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xbee38, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0xbee38, lpOverlapped=0x0) returned 1 [0256.897] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.925] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.939] CloseHandle (hObject=0x1ec) returned 1 [0256.940] CloseHandle (hObject=0x1f8) returned 1 [0256.940] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.z49-css-qhb")) returned 0 [0256.941] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.z49-css-qhb")) returned 0x20 [0256.941] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0x7e2a88 [0256.941] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0256.942] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0256.942] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe")) returned 1 [0256.952] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe")) returned 0xffffffff [0256.953] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0256.953] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0256.953] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646572, dwReserved1=0x782e7473, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0256.953] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0256.954] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0256.954] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0256.955] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x1004, dwReserved1=0x40221d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0256.955] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0256.955] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0256.958] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71080 [0256.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0256.959] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0257.132] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x71080, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x71080, lpOverlapped=0x0) returned 1 [0257.139] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x71080, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x71080, lpOverlapped=0x0) returned 1 [0257.151] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.183] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.200] CloseHandle (hObject=0x1f8) returned 1 [0257.201] CloseHandle (hObject=0x1ec) returned 1 [0257.202] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.z49-css-qhb")) returned 0 [0257.202] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.z49-css-qhb")) returned 0x20 [0257.203] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x7e2a08 [0257.203] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0257.203] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0257.203] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe")) returned 1 [0257.210] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe")) returned 0xffffffff [0257.211] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x1004, dwReserved1=0x40221d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0257.211] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0257.211] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73696465, dwReserved1=0x38785f74, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0257.211] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x101c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0257.212] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x101c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0257.212] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x101c, dwReserved1=0x40221d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0257.212] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0257.212] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0257.213] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0257.216] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbee30 [0257.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0257.217] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0257.357] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0xbee30, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0xbee30, lpOverlapped=0x0) returned 1 [0257.378] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xbee30, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0xbee30, lpOverlapped=0x0) returned 1 [0257.398] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.426] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.439] CloseHandle (hObject=0x1ec) returned 1 [0257.440] CloseHandle (hObject=0x1f8) returned 1 [0257.440] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.z49-css-qhb")) returned 0 [0257.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.z49-css-qhb")) returned 0x20 [0257.441] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0x7e2c08 [0257.441] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0257.441] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0257.441] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe")) returned 1 [0257.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe")) returned 0xffffffff [0257.450] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0257.450] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0257.450] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646572, dwReserved1=0x782e7473, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0257.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1068, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0257.451] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1068, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0257.451] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1068, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 1 [0257.451] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0257.451] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.451] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0257.451] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0257.454] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="..", cAlternateFileName="")) returned 1 [0257.454] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x4000004, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0257.455] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0257.455] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0257.457] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b4520 [0257.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0257.458] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0257.577] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x4b4520, lpOverlapped=0x0) returned 1 [0257.750] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4b4520, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x4b4520, lpOverlapped=0x0) returned 1 [0257.938] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.970] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.985] CloseHandle (hObject=0x1e8) returned 1 [0257.985] CloseHandle (hObject=0x1fc) returned 1 [0257.986] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb")) returned 0 [0257.987] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.z49-css-qhb")) returned 0x20 [0257.987] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0x7e2848 [0257.987] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0257.987] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0257.988] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0257.998] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0257.998] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0257.999] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0258.000] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0258.000] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0258.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0258.001] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0258.145] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0258.153] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x23000, lpOverlapped=0x0) returned 1 [0258.157] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.187] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.203] CloseHandle (hObject=0x1fc) returned 1 [0258.203] CloseHandle (hObject=0x1e8) returned 1 [0258.204] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb")) returned 0 [0258.205] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.z49-css-qhb" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.z49-css-qhb")) returned 0x20 [0258.205] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x7e2a88 [0258.205] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0258.205] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0258.206] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0258.208] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0258.208] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0258.208] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0258.208] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0258.208] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0258.208] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1068, dwReserved1=0x40221d, cFileName="packages", cAlternateFileName="")) returned 0 [0258.209] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0258.209] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646572, dwReserved1=0x782e7473, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0258.209] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0258.209] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42454643, dwReserved1=0x412d3232, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0258.209] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe1fe74db, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x782e7473, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0258.209] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe1fe74db, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6567616b, dwReserved1=0x782e7473, cFileName="..", cAlternateFileName="")) returned 1 [0258.209] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x6567616b, dwReserved1=0x782e7473, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0258.210] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0258.210] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1 [0258.211] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe1fe74db, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe207444e, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x1014, dwReserved1=0x40221d, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0258.211] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe1fe74db, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe207444e, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x1014, dwReserved1=0x40221d, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0258.211] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0258.211] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x312e6469, dwReserved1=0x2d313939, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0258.211] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0258.212] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0258.212] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0258.212] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0258.212] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d313939, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0258.212] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="È%~")) returned 0xffffffff [0258.213] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d313939, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0258.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="È%~")) returned 0xffffffff [0258.213] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2d313939, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0258.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0258.213] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0258.213] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1f10f26, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xa1f10f26, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0258.213] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1f10f26, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0x4d15b86, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0258.213] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1f10f26, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0x4d15b86, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="..", cAlternateFileName="")) returned 1 [0258.214] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x69746e75, dwReserved1=0x6441656d, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1 [0258.214] CreateFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0258.216] CreateFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0258.217] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a [0258.217] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0258.218] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0258.312] ReadFile (in: hFile=0x1f8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x1a, lpOverlapped=0x0) returned 1 [0258.314] WriteFile (in: hFile=0x1ec, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x1a, lpOverlapped=0x0) returned 1 [0258.316] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.360] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.375] CloseHandle (hObject=0x1f8) returned 1 [0258.376] CloseHandle (hObject=0x1ec) returned 1 [0258.376] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), lpNewFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml.z49-css-qhb")) returned 0 [0258.377] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml.z49-css-qhb")) returned 0x20 [0258.377] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 0x7e2c08 [0258.377] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 0 [0258.377] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0258.378] DeleteFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml")) returned 1 [0258.379] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml")) returned 0xffffffff [0258.379] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1e521b3, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xa1f10f26, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0258.380] CreateFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0258.381] CreateFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f8 [0258.381] GetFileSize (in: hFile=0x1ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a4 [0258.381] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0258.382] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0258.478] ReadFile (in: hFile=0x1ec, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f07c*=0x5a4, lpOverlapped=0x0) returned 1 [0258.479] WriteFile (in: hFile=0x1f8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x19f07c, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f07c*=0x5a4, lpOverlapped=0x0) returned 1 [0258.480] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.542] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.558] CloseHandle (hObject=0x1ec) returned 1 [0258.559] CloseHandle (hObject=0x1f8) returned 1 [0258.559] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb")) returned 0 [0258.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb")) returned 0x20 [0258.560] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1e521b3, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xa1f10f26, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0x7e2a08 [0258.561] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1e521b3, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xa1f10f26, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0 [0258.561] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0258.561] DeleteFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 1 [0258.562] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0xffffffff [0258.562] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d15b86, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0x4d15b86, ftLastAccessTime.dwHighDateTime=0x1d5e399, ftLastWriteTime.dwLowDateTime=0x4dae5bd, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~3.XML")) returned 1 [0258.563] CreateFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0258.563] CloseHandle (hObject=0xffffffff) returned 1 [0258.563] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb")) returned 0 [0258.563] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.z49-css-qhb")) returned 0xffffffff [0258.564] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d15b86, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0x4d15b86, ftLastAccessTime.dwHighDateTime=0x1d5e399, ftLastWriteTime.dwLowDateTime=0x4dae5bd, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~3.XML")) returned 0x7e2708 [0258.564] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19ef78 | out: lpFindFileData=0x19ef78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d15b86, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0x4d15b86, ftLastAccessTime.dwHighDateTime=0x1d5e399, ftLastWriteTime.dwLowDateTime=0x4dae5bd, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~3.XML")) returned 0 [0258.564] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0258.564] DeleteFileA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0 [0258.564] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0x20 [0258.564] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d15b86, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0x4d15b86, ftLastAccessTime.dwHighDateTime=0x1d5e399, ftLastWriteTime.dwLowDateTime=0x4dae5bd, ftLastWriteTime.dwHighDateTime=0x1d5e399, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~3.XML")) returned 0 [0258.564] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0258.565] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa1f10f26, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xa1f10f26, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1044, dwReserved1=0x40221d, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0258.565] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0258.565] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53657461, dwReserved1=0x65726f74, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0258.565] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOShared\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x65726f74, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0258.565] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x65726f74, cFileName="..", cAlternateFileName="")) returned 1 [0258.565] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe009c7ad, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe009c7ad, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x65726f74, cFileName="Logs", cAlternateFileName="")) returned 1 [0258.565] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe009c7ad, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe009c7ad, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0258.567] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe009c7ad, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe009c7ad, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0258.568] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1 [0258.568] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1 [0258.568] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="NotificationUxBroker.001.etl", cAlternateFileName="NO604C~1.ETL")) returned 1 [0258.569] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.002.etl", cAlternateFileName="NO8BA4~1.ETL")) returned 1 [0258.569] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.003.etl", cAlternateFileName="NO3670~1.ETL")) returned 1 [0258.569] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.004.etl", cAlternateFileName="NO2FB3~1.ETL")) returned 1 [0258.569] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xb50917ed, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.005.etl", cAlternateFileName="NO74F7~1.ETL")) returned 1 [0258.569] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8728eea2, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.006.etl", cAlternateFileName="NOC92C~1.ETL")) returned 1 [0258.570] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xebc8ba4e, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.007.etl", cAlternateFileName="NOAEB3~1.ETL")) returned 1 [0258.570] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe10d621a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.008.etl", cAlternateFileName="NO6494~1.ETL")) returned 1 [0258.570] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x2fc89ca0, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.009.etl", cAlternateFileName="NO492C~1.ETL")) returned 1 [0258.570] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd87b395e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.010.etl", cAlternateFileName="NO0EF1~1.ETL")) returned 1 [0258.571] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x20000d39, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.011.etl", cAlternateFileName="NOC3D2~1.ETL")) returned 1 [0258.571] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x46eecb64, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.012.etl", cAlternateFileName="NOA86A~1.ETL")) returned 1 [0258.571] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x23917bad, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.013.etl", cAlternateFileName="NO3128~1.ETL")) returned 1 [0258.571] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8f779518, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.014.etl", cAlternateFileName="NO43D2~1.ETL")) returned 1 [0258.571] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7fc1b6b8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.015.etl", cAlternateFileName="NOTIFI~4.ETL")) returned 1 [0258.571] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb5c1a4e, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.016.etl", cAlternateFileName="NOTIFI~3.ETL")) returned 1 [0258.572] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8be7d51, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="NotificationUxBroker.017.etl", cAlternateFileName="NOTIFI~1.ETL")) returned 1 [0258.572] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe009c7ad, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe009c7ad, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1 [0258.572] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x93a88810, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xc8d5fe22, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1 [0258.572] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x917b63d4, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb8b481f0, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1 [0258.572] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x150f0f86, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x39296693, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1 [0258.573] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1f83bc0, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x32ea756e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1 [0258.573] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfdc37a18, ftLastAccessTime.dwHighDateTime=0x1d5d80e, ftLastWriteTime.dwLowDateTime=0x290206fd, ftLastWriteTime.dwHighDateTime=0x1d5d80f, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1 [0258.573] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8a5979b2, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x8a5979b2, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1 [0258.574] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcbc9fc38, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xefa43826, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1 [0258.574] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf1e2e9c9, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x1ca46d4f, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1 [0258.574] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf7e12839, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x26688c0b, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.010.etl", cAlternateFileName="UPB13B~1.ETL")) returned 1 [0258.574] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.011.etl", cAlternateFileName="UP076F~1.ETL")) returned 1 [0258.574] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x4e6dab1f, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.012.etl", cAlternateFileName="UPEBF6~1.ETL")) returned 1 [0258.575] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x5454d5b0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.013.etl", cAlternateFileName="UP8DEE~1.ETL")) returned 1 [0258.575] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x60de6047, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.014.etl", cAlternateFileName="UP38BA~1.ETL")) returned 1 [0258.575] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xcb3f3780, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.015.etl", cAlternateFileName="UPE286~1.ETL")) returned 1 [0258.575] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8784f695, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.016.etl", cAlternateFileName="UP9D42~1.ETL")) returned 1 [0258.575] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4346f4fe, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.017.etl", cAlternateFileName="UPB8BA~1.ETL")) returned 1 [0258.576] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x318cac0d, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.018.etl", cAlternateFileName="UPAC79~1.ETL")) returned 1 [0258.576] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd59be406, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.019.etl", cAlternateFileName="UP1E42~1.ETL")) returned 1 [0258.576] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3f449663, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.020.etl", cAlternateFileName="UP597C~1.ETL")) returned 1 [0258.576] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58b60423, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.021.etl", cAlternateFileName="UP0CB7~1.ETL")) returned 1 [0258.576] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x87be9f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.022.etl", cAlternateFileName="UPBE04~1.ETL")) returned 1 [0258.577] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1977635c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.023.etl", cAlternateFileName="UPA620~1.ETL")) returned 1 [0258.577] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x2521b8a4, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.024.etl", cAlternateFileName="UP14AB~1.ETL")) returned 1 [0258.577] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfd9caf15, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.025.etl", cAlternateFileName="UP4198~1.ETL")) returned 1 [0258.577] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb10a27a8, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.026.etl", cAlternateFileName="UP96CC~1.ETL")) returned 1 [0258.577] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x79d33ce, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.027.etl", cAlternateFileName="UP7B54~1.ETL")) returned 1 [0258.578] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x56762f51, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.028.etl", cAlternateFileName="UPC098~1.ETL")) returned 1 [0258.578] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x46bc7f04, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.029.etl", cAlternateFileName="UP16CC~1.ETL")) returned 1 [0258.578] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x911dff9b, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.030.etl", cAlternateFileName="UPDA92~1.ETL")) returned 1 [0258.578] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0xb62eafb0, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.031.etl", cAlternateFileName="UPBF2A~1.ETL")) returned 1 [0258.578] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x82808de1, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.032.etl", cAlternateFileName="UP750B~1.ETL")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xf21e09d1, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.033.etl", cAlternateFileName="UP6487~1.ETL")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x2e5f9ec7, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.034.etl", cAlternateFileName="UPDATE~4.ETL")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xe1a1828d, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.035.etl", cAlternateFileName="UPDATE~3.ETL")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xe19a12b7, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.036.etl", cAlternateFileName="UPDATE~2.ETL")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x266bdfb9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateSessionOrchestration.037.etl", cAlternateFileName="UPDATE~1.ETL")) returned 1 [0258.580] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x889a9e61, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="UpdateUx.001.etl", cAlternateFileName="UP654C~1.ETL")) returned 1 [0258.580] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 1 [0258.580] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 0 [0258.580] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0258.581] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe009c7ad, ftLastAccessTime.dwHighDateTime=0x1d5e398, ftLastWriteTime.dwLowDateTime=0xe009c7ad, ftLastWriteTime.dwHighDateTime=0x1d5e398, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657461, dwReserved1=0x65726f74, cFileName="Logs", cAlternateFileName="")) returned 0 [0258.581] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0258.581] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53657473, dwReserved1=0x65726f74, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0258.581] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0258.582] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName="..", cAlternateFileName="")) returned 1 [0258.582] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 1 [0258.582] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0258.582] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0258.582] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0258.582] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0258.583] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0258.583] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0258.583] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53657473, dwReserved1=0x65726f74, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0258.583] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0258.584] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x6f6c6f48, cFileName="Default", cAlternateFileName="")) returned 1 [0258.584] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c616974, dwReserved1=0x726f7453, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0258.584] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c616974, dwReserved1=0x726f7453, cFileName="..", cAlternateFileName="")) returned 1 [0258.585] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c616974, dwReserved1=0x726f7453, cFileName="AppData", cAlternateFileName="")) returned 1 [0258.585] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0258.585] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName="..", cAlternateFileName="")) returned 1 [0258.585] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55657461, dwReserved1=0x30302e78, cFileName="Local", cAlternateFileName="")) returned 1 [0258.585] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0258.586] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.586] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0258.586] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x7f7148, ftCreationTime.dwLowDateTime=0x48, ftCreationTime.dwHighDateTime=0x201, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10098, ftLastWriteTime.dwLowDateTime=0x7ded08, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x7fcd70, nFileSizeLow=0x181, dwReserved0=0x1000008, dwReserved1=0x7d00c0, cFileName="", cAlternateFileName="\x08&~")) returned 0xffffffff [0258.586] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0258.586] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x7f7148, ftCreationTime.dwLowDateTime=0x48, ftCreationTime.dwHighDateTime=0x201, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10098, ftLastWriteTime.dwLowDateTime=0x7ded08, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x7fcd70, nFileSizeLow=0x181, dwReserved0=0x1000008, dwReserved1=0x7d00c0, cFileName="", cAlternateFileName="\x08&~")) returned 0xffffffff [0258.586] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0258.586] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0258.587] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.587] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa27e7c13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa27e7c13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0258.587] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa27e7c13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa27e7c13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0258.587] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa27e7c13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa27e7c13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.587] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1 [0258.587] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0258.589] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.589] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0258.589] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0258.589] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 0 [0258.589] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0258.589] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64656e69, dwReserved1=0x61746144, cFileName="Windows", cAlternateFileName="")) returned 1 [0258.589] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0258.591] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.591] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55059, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CloudStore", cAlternateFileName="CLOUDS~1")) returned 1 [0258.591] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\CloudStore\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55059, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0258.591] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55059, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.591] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55059, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0258.591] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0258.591] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0258.591] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0258.592] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.592] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0258.592] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0258.592] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b5650c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0258.592] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b5650c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0258.592] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b5650c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.592] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b5650c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0258.592] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0258.592] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b56b05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0258.592] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b56b05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0258.593] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b56b05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.593] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b56b05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0258.593] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0258.593] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b570a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0258.593] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b570a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0258.595] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b570a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.595] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b570a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0258.595] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0258.595] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b57759, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1 [0258.595] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b57759, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0258.595] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b57759, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0258.595] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 1 [0258.596] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0258.598] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0258.613] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1be33 [0258.613] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0258.614] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0258.810] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1be33, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x1be33, lpOverlapped=0x0) returned 1 [0258.820] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1be33, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x1be33, lpOverlapped=0x0) returned 1 [0258.823] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.858] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.874] CloseHandle (hObject=0x1fc) returned 1 [0258.874] CloseHandle (hObject=0x1f4) returned 1 [0258.875] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml.z49-css-qhb")) returned 0 [0258.875] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml.z49-css-qhb")) returned 0x20 [0258.876] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 0x7e2b88 [0258.876] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 0 [0258.876] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0258.876] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml")) returned 1 [0258.881] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml")) returned 0xffffffff [0258.881] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 0 [0258.881] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0258.881] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6f79614c, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0258.881] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="DefaultLayouts.xml", cAlternateFileName="H(~")) returned 0xffffffff [0258.881] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6f79614c, cFileName="WinX", cAlternateFileName="")) returned 1 [0258.882] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0258.882] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0258.882] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3bc20b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="Group1", cAlternateFileName="")) returned 1 [0258.882] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3bc20b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0258.883] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3bc20b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.883] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Desktop.lnk", cAlternateFileName="")) returned 1 [0258.883] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0258.884] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0258.884] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0258.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0258.884] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0259.015] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.018] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x455, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.020] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.052] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.133] CloseHandle (hObject=0x1fc) returned 1 [0259.134] CloseHandle (hObject=0x1f0) returned 1 [0259.134] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.z49-css-qhb")) returned 0 [0259.135] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.z49-css-qhb")) returned 0x20 [0259.135] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="1 - Desktop.lnk", cAlternateFileName="")) returned 0x7e2648 [0259.135] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="1 - Desktop.lnk", cAlternateFileName="")) returned 0 [0259.135] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0259.135] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk")) returned 1 [0259.136] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk")) returned 0xffffffff [0259.136] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f9d343, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8ea7682, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x4c, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0259.136] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0259.137] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0259.138] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b [0259.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0259.138] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0259.239] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4b, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x4b, lpOverlapped=0x0) returned 1 [0259.241] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x4b, lpOverlapped=0x0) returned 1 [0259.242] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.276] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.291] CloseHandle (hObject=0x1f0) returned 1 [0259.292] CloseHandle (hObject=0x1fc) returned 1 [0259.292] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.z49-css-qhb")) returned 0 [0259.293] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.z49-css-qhb")) returned 0x20 [0259.293] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f9d343, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8ea7682, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2648 [0259.293] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f9d343, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8ea7682, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0259.293] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0259.293] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini")) returned 1 [0259.295] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini")) returned 0xffffffff [0259.295] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f9d343, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8ea7682, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x4c, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0259.295] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0259.295] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c33bd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="Group2", cAlternateFileName="")) returned 1 [0259.295] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c33bd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0259.297] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c33bd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0259.297] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0xa8, dwReserved1=0x40221d, cFileName="1 - Run.lnk", cAlternateFileName="")) returned 1 [0259.298] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0259.298] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0259.299] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0259.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0259.300] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0259.386] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.388] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x455, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.390] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.418] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.432] CloseHandle (hObject=0x1fc) returned 1 [0259.432] CloseHandle (hObject=0x1f0) returned 1 [0259.433] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.z49-css-qhb")) returned 0 [0259.433] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.z49-css-qhb")) returned 0x20 [0259.433] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="1 - Run.lnk", cAlternateFileName="")) returned 0x7e2548 [0259.434] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="1 - Run.lnk", cAlternateFileName="")) returned 0 [0259.434] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0259.434] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk")) returned 1 [0259.434] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk")) returned 0xffffffff [0259.434] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x84, dwReserved1=0x40221d, cFileName="2 - Search.lnk", cAlternateFileName="")) returned 1 [0259.435] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0259.435] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0259.435] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0259.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0259.436] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0259.518] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.520] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x455, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.521] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.546] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.560] CloseHandle (hObject=0x1f0) returned 1 [0259.560] CloseHandle (hObject=0x1fc) returned 1 [0259.561] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.z49-css-qhb")) returned 0 [0259.561] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.z49-css-qhb")) returned 0x20 [0259.561] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="2 - Search.lnk", cAlternateFileName="")) returned 0x7e2888 [0259.561] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="2 - Search.lnk", cAlternateFileName="")) returned 0 [0259.561] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0259.562] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk")) returned 1 [0259.562] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk")) returned 0xffffffff [0259.562] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="")) returned 1 [0259.562] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0259.564] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0259.564] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0259.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0259.564] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0259.811] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.813] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x455, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x455, lpOverlapped=0x0) returned 1 [0259.814] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.939] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.960] CloseHandle (hObject=0x1fc) returned 1 [0259.961] CloseHandle (hObject=0x1f0) returned 1 [0259.961] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.z49-css-qhb")) returned 0 [0259.962] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.z49-css-qhb")) returned 0x20 [0259.962] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="")) returned 0x7e2a88 [0259.962] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="")) returned 0 [0259.962] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0259.962] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk")) returned 1 [0259.963] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk")) returned 0xffffffff [0259.963] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d4, dwReserved0=0x44, dwReserved1=0x40221d, cFileName="4 - Control Panel.lnk", cAlternateFileName="")) returned 1 [0259.963] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0259.964] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0259.965] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d4 [0259.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0259.966] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0260.125] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5d4, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x5d4, lpOverlapped=0x0) returned 1 [0260.478] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5d4, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x5d4, lpOverlapped=0x0) returned 1 [0260.480] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.512] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.530] CloseHandle (hObject=0x1f0) returned 1 [0260.531] CloseHandle (hObject=0x1fc) returned 1 [0260.531] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.z49-css-qhb")) returned 0 [0260.532] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.z49-css-qhb")) returned 0x20 [0260.532] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="4 - Control Panel.lnk", cAlternateFileName="")) returned 0x7e2a08 [0260.532] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="4 - Control Panel.lnk", cAlternateFileName="")) returned 0 [0260.532] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0260.532] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk")) returned 1 [0260.532] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk")) returned 0xffffffff [0260.533] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="5 - Task Manager.lnk", cAlternateFileName="")) returned 1 [0260.533] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0260.533] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0260.534] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fd [0260.534] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0260.534] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0260.635] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3fd, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3fd, lpOverlapped=0x0) returned 1 [0260.669] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3fd, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3fd, lpOverlapped=0x0) returned 1 [0260.671] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.701] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.717] CloseHandle (hObject=0x1fc) returned 1 [0260.717] CloseHandle (hObject=0x1f0) returned 1 [0260.718] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.z49-css-qhb")) returned 0 [0260.718] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.z49-css-qhb")) returned 0x20 [0260.718] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="5 - Task Manager.lnk", cAlternateFileName="")) returned 0x7e25c8 [0260.719] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="5 - Task Manager.lnk", cAlternateFileName="")) returned 0 [0260.719] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0260.719] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk")) returned 1 [0260.719] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk")) returned 0xffffffff [0260.719] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0260.720] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0260.720] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0260.721] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145 [0260.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0260.722] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0260.832] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x145, lpOverlapped=0x0) returned 1 [0260.833] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x145, lpOverlapped=0x0) returned 1 [0260.835] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.868] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.883] CloseHandle (hObject=0x1f0) returned 1 [0260.883] CloseHandle (hObject=0x1fc) returned 1 [0260.883] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.z49-css-qhb")) returned 0 [0260.884] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.z49-css-qhb")) returned 0x20 [0260.884] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2548 [0260.884] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0260.884] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0260.885] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini")) returned 1 [0260.886] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini")) returned 0xffffffff [0260.886] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0260.886] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0260.886] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="Group3", cAlternateFileName="")) returned 1 [0260.886] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0260.953] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0260.953] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0260.954] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0260.955] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0260.955] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0260.956] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0260.956] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0261.137] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0261.141] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0261.143] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.175] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.190] CloseHandle (hObject=0x1fc) returned 1 [0261.191] CloseHandle (hObject=0x1f0) returned 1 [0261.191] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.z49-css-qhb")) returned 0 [0261.191] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.z49-css-qhb")) returned 0x20 [0261.192] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 0x7e2688 [0261.192] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 0 [0261.192] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0261.192] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk")) returned 1 [0261.192] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk")) returned 0xffffffff [0261.192] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0261.193] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0261.193] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0261.193] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x467 [0261.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0261.194] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0261.285] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x467, lpOverlapped=0x0) returned 1 [0261.288] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x467, lpOverlapped=0x0) returned 1 [0261.290] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.324] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.340] CloseHandle (hObject=0x1f0) returned 1 [0261.340] CloseHandle (hObject=0x1fc) returned 1 [0261.341] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.z49-css-qhb")) returned 0 [0261.342] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.z49-css-qhb")) returned 0x20 [0261.342] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 0x7e2a48 [0261.342] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 0 [0261.342] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0261.342] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk")) returned 1 [0261.342] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk")) returned 0xffffffff [0261.343] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0261.343] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0261.343] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0261.345] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x423 [0261.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0261.346] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0261.436] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x423, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x423, lpOverlapped=0x0) returned 1 [0261.441] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x423, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x423, lpOverlapped=0x0) returned 1 [0261.443] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.473] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.489] CloseHandle (hObject=0x1fc) returned 1 [0261.489] CloseHandle (hObject=0x1f0) returned 1 [0261.490] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.z49-css-qhb")) returned 0 [0261.491] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.z49-css-qhb")) returned 0x20 [0261.491] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 0x7e2688 [0261.491] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 0 [0261.491] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0261.491] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk")) returned 1 [0261.492] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk")) returned 0xffffffff [0261.492] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0261.492] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0261.493] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0261.493] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x493 [0261.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0261.493] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0261.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x493, lpOverlapped=0x0) returned 1 [0261.593] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x493, lpOverlapped=0x0) returned 1 [0261.595] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.636] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.654] CloseHandle (hObject=0x1f0) returned 1 [0261.654] CloseHandle (hObject=0x1fc) returned 1 [0261.654] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.z49-css-qhb")) returned 0 [0261.655] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.z49-css-qhb")) returned 0x20 [0261.655] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 0x7e25c8 [0261.655] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 0 [0261.655] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0261.656] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk")) returned 1 [0261.656] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk")) returned 0xffffffff [0261.656] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 1 [0261.657] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0261.657] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0261.657] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0261.657] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0261.658] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0261.843] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0261.846] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0261.847] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.882] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.896] CloseHandle (hObject=0x1fc) returned 1 [0261.897] CloseHandle (hObject=0x1f0) returned 1 [0261.897] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.z49-css-qhb")) returned 0 [0261.898] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.z49-css-qhb")) returned 0x20 [0261.898] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 0x7e2b08 [0261.898] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 0 [0261.898] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0261.898] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk")) returned 1 [0261.899] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk")) returned 0xffffffff [0261.899] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 1 [0261.899] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0261.900] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0261.901] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0261.901] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0261.901] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.014] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0262.023] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0262.024] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.101] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.118] CloseHandle (hObject=0x1f0) returned 1 [0262.118] CloseHandle (hObject=0x1fc) returned 1 [0262.119] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.z49-css-qhb")) returned 0 [0262.120] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.z49-css-qhb")) returned 0x20 [0262.120] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 0x7e2908 [0262.120] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 0 [0262.120] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0262.120] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk")) returned 1 [0262.121] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk")) returned 0xffffffff [0262.121] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="04-1 - NetworkStatus.lnk", cAlternateFileName="")) returned 1 [0262.121] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.122] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0262.122] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62e [0262.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0262.122] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.255] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x62e, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x62e, lpOverlapped=0x0) returned 1 [0262.257] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x62e, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x62e, lpOverlapped=0x0) returned 1 [0262.258] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.286] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.302] CloseHandle (hObject=0x1fc) returned 1 [0262.302] CloseHandle (hObject=0x1f0) returned 1 [0262.302] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.z49-css-qhb")) returned 0 [0262.303] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk.z49-css-qhb")) returned 0x20 [0262.303] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="04-1 - NetworkStatus.lnk", cAlternateFileName="")) returned 0x7e2a48 [0262.303] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="04-1 - NetworkStatus.lnk", cAlternateFileName="")) returned 0 [0262.303] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0262.304] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk")) returned 1 [0262.304] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - NetworkStatus.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - networkstatus.lnk")) returned 0xffffffff [0262.304] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 1 [0262.305] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0262.305] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.306] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x433 [0262.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0262.307] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.385] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x433, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x433, lpOverlapped=0x0) returned 1 [0262.388] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x433, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x433, lpOverlapped=0x0) returned 1 [0262.389] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.414] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.429] CloseHandle (hObject=0x1f0) returned 1 [0262.430] CloseHandle (hObject=0x1fc) returned 1 [0262.430] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.z49-css-qhb")) returned 0 [0262.431] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.z49-css-qhb")) returned 0x20 [0262.431] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 0x7e2908 [0262.431] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 0 [0262.431] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0262.432] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk")) returned 1 [0262.432] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk")) returned 0xffffffff [0262.432] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="06 - SystemAbout.lnk", cAlternateFileName="")) returned 1 [0262.433] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.433] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0262.433] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x628 [0262.434] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0262.434] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.510] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x628, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x628, lpOverlapped=0x0) returned 1 [0262.512] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x628, lpOverlapped=0x0) returned 1 [0262.513] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.541] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.557] CloseHandle (hObject=0x1fc) returned 1 [0262.557] CloseHandle (hObject=0x1f0) returned 1 [0262.558] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.z49-css-qhb")) returned 0 [0262.558] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk.z49-css-qhb")) returned 0x20 [0262.558] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="06 - SystemAbout.lnk", cAlternateFileName="")) returned 0x7e2548 [0262.558] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="06 - SystemAbout.lnk", cAlternateFileName="")) returned 0 [0262.558] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0262.559] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk")) returned 1 [0262.559] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - SystemAbout.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - systemabout.lnk")) returned 0xffffffff [0262.559] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x78, dwReserved1=0x40221d, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 1 [0262.560] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0262.560] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.560] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0262.560] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0262.561] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.694] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0262.696] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0262.698] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.728] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.742] CloseHandle (hObject=0x1f0) returned 1 [0262.743] CloseHandle (hObject=0x1fc) returned 1 [0262.743] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.z49-css-qhb")) returned 0 [0262.744] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.z49-css-qhb")) returned 0x20 [0262.744] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 0x7e2548 [0262.744] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 0 [0262.744] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0262.744] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk")) returned 1 [0262.745] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk")) returned 0xffffffff [0262.745] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="08 - PowerAndSleep.lnk", cAlternateFileName="")) returned 1 [0262.745] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.746] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0262.746] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62a [0262.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0262.747] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.822] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x62a, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x62a, lpOverlapped=0x0) returned 1 [0262.824] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x62a, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x62a, lpOverlapped=0x0) returned 1 [0262.825] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.850] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.864] CloseHandle (hObject=0x1fc) returned 1 [0262.865] CloseHandle (hObject=0x1f0) returned 1 [0262.865] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.z49-css-qhb")) returned 0 [0262.866] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk.z49-css-qhb")) returned 0x20 [0262.866] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="08 - PowerAndSleep.lnk", cAlternateFileName="")) returned 0x7e2548 [0262.866] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="08 - PowerAndSleep.lnk", cAlternateFileName="")) returned 0 [0262.866] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0262.866] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk")) returned 1 [0262.866] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - PowerAndSleep.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - powerandsleep.lnk")) returned 0xffffffff [0262.866] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 1 [0262.867] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0262.867] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.868] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0262.868] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0262.868] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0262.938] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0262.956] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3f7, lpOverlapped=0x0) returned 1 [0262.958] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.983] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.996] CloseHandle (hObject=0x1f0) returned 1 [0262.996] CloseHandle (hObject=0x1fc) returned 1 [0262.996] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.z49-css-qhb")) returned 0 [0262.997] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.z49-css-qhb")) returned 0x20 [0262.997] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 0x7e2548 [0262.997] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 0 [0262.997] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0262.997] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk")) returned 1 [0262.997] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk")) returned 0xffffffff [0262.998] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x9e4, dwReserved1=0x40221d, cFileName="10 - AppsAndFeatures.lnk", cAlternateFileName="")) returned 1 [0262.998] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0262.998] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0263.000] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62a [0263.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0263.001] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0263.143] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x62a, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x62a, lpOverlapped=0x0) returned 1 [0263.147] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x62a, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x62a, lpOverlapped=0x0) returned 1 [0263.148] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.176] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.189] CloseHandle (hObject=0x1fc) returned 1 [0263.189] CloseHandle (hObject=0x1f0) returned 1 [0263.189] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.z49-css-qhb")) returned 0 [0263.190] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk.z49-css-qhb")) returned 0x20 [0263.190] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="10 - AppsAndFeatures.lnk", cAlternateFileName="")) returned 0x7e2888 [0263.190] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="10 - AppsAndFeatures.lnk", cAlternateFileName="")) returned 0 [0263.190] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0263.190] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk")) returned 1 [0263.190] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - AppsAndFeatures.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - appsandfeatures.lnk")) returned 0xffffffff [0263.190] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0263.191] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0263.192] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0263.193] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad [0263.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0263.194] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0263.264] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x3ad, lpOverlapped=0x0) returned 1 [0263.267] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x3ad, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x3ad, lpOverlapped=0x0) returned 1 [0263.268] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.294] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.307] CloseHandle (hObject=0x1f0) returned 1 [0263.307] CloseHandle (hObject=0x1fc) returned 1 [0263.307] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.z49-css-qhb")) returned 0 [0263.308] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.z49-css-qhb")) returned 0x20 [0263.308] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2a48 [0263.308] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0263.308] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0263.308] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini")) returned 1 [0263.309] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini")) returned 0xffffffff [0263.309] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0263.309] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0263.309] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="Group3", cAlternateFileName="")) returned 0 [0263.309] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0263.309] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6f79614c, cFileName="WinX", cAlternateFileName="")) returned 0 [0263.310] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0263.310] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61726f58, dwReserved1=0x49207972, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0263.310] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0337075, dwReserved1=0x6f79614c, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0263.310] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0337075, dwReserved1=0x6f79614c, cFileName="..", cAlternateFileName="")) returned 1 [0263.310] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0337075, dwReserved1=0x6f79614c, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0263.310] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0263.311] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="..", cAlternateFileName="")) returned 1 [0263.311] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="..", cAlternateFileName="")) returned 0 [0263.311] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0263.311] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0337075, dwReserved1=0x6f79614c, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0263.312] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0263.314] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0263.314] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0263.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0263.314] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0263.435] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x50, lpOverlapped=0x0) returned 1 [0263.437] WriteFile (in: hFile=0x1f4, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x50, lpOverlapped=0x0) returned 1 [0263.438] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.472] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.488] CloseHandle (hObject=0x1e8) returned 1 [0263.488] CloseHandle (hObject=0x1f4) returned 1 [0263.488] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.z49-css-qhb")) returned 0 [0263.489] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.z49-css-qhb")) returned 0x20 [0263.489] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="settings.ini", cAlternateFileName="")) returned 0x7e2848 [0263.489] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="settings.ini", cAlternateFileName="")) returned 0 [0263.489] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0263.489] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0263.491] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0263.491] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0337075, dwReserved1=0x6f79614c, cFileName="settings.ini", cAlternateFileName="")) returned 0 [0263.491] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0263.491] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 1 [0263.491] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\WindowsApps\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0263.491] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0263.492] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0263.492] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0263.492] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 0 [0263.492] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0263.492] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x73707041, cFileName="Temp", cAlternateFileName="")) returned 1 [0263.492] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0263.492] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="..", cAlternateFileName="")) returned 1 [0263.492] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="..", cAlternateFileName="")) returned 0 [0263.492] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0263.492] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73707041, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0263.493] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="..", cAlternateFileName="\x08&~")) returned 0xffffffff [0263.493] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73707041, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0263.493] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0263.493] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61726f70, dwReserved1=0x49207972, cFileName="Roaming", cAlternateFileName="")) returned 1 [0263.493] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73707041, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0263.494] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73707041, cFileName="..", cAlternateFileName="")) returned 1 [0263.494] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73707041, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0263.494] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0263.494] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="..", cAlternateFileName="")) returned 1 [0263.494] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x6e692e73, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0263.494] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0263.494] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.494] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0263.494] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0263.495] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0263.495] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0263.495] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0263.498] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0263.501] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0263.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0263.502] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0263.592] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x94, lpOverlapped=0x0) returned 1 [0263.595] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x94, lpOverlapped=0x0) returned 1 [0263.596] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.647] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.664] CloseHandle (hObject=0x1e8) returned 1 [0263.664] CloseHandle (hObject=0x1fc) returned 1 [0263.664] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.z49-css-qhb")) returned 0 [0263.665] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.z49-css-qhb")) returned 0x20 [0263.665] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2908 [0263.665] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0263.665] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0263.665] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0263.667] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0263.667] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 1 [0263.668] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0263.668] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0263.668] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0263.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0263.669] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0263.860] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x160, lpOverlapped=0x0) returned 1 [0263.862] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x160, lpOverlapped=0x0) returned 1 [0263.863] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.896] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.911] CloseHandle (hObject=0x1fc) returned 1 [0263.912] CloseHandle (hObject=0x1e8) returned 1 [0263.912] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.z49-css-qhb")) returned 0 [0263.913] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.z49-css-qhb")) returned 0x20 [0263.913] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 0x7e2ac8 [0263.913] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 0 [0263.913] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0263.913] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0263.913] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0263.914] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 1 [0263.914] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0263.914] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0263.915] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0263.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0263.915] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0264.006] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x14e, lpOverlapped=0x0) returned 1 [0264.008] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x14e, lpOverlapped=0x0) returned 1 [0264.009] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.044] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.121] CloseHandle (hObject=0x1e8) returned 1 [0264.121] CloseHandle (hObject=0x1fc) returned 1 [0264.122] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.z49-css-qhb")) returned 0 [0264.123] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.z49-css-qhb")) returned 0x20 [0264.123] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 0x7e2888 [0264.123] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 0 [0264.123] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0264.123] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0264.123] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0264.123] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 0 [0264.124] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0264.124] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0264.124] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0264.124] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c206b63, dwReserved1=0x636e7561, cFileName="Network", cAlternateFileName="")) returned 1 [0264.124] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20776f64, dwReserved1=0x74697753, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0264.129] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20776f64, dwReserved1=0x74697753, cFileName="..", cAlternateFileName="")) returned 1 [0264.129] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20776f64, dwReserved1=0x74697753, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0264.129] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0264.129] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.129] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="Cm", cAlternateFileName="")) returned 1 [0264.129] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0264.129] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0264.130] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0264.130] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0264.130] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="_hiddencm", cAlternateFileName="_HIDDE~1")) returned 1 [0264.130] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0264.130] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0264.130] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0264.130] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0264.130] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="_hiddencm", cAlternateFileName="_HIDDE~1")) returned 0 [0264.130] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0264.130] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20776f64, dwReserved1=0x74697753, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0264.130] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0264.130] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7463656e, dwReserved1=0x736e6f69, cFileName="Windows", cAlternateFileName="")) returned 1 [0264.131] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0264.141] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName="..", cAlternateFileName="")) returned 1 [0264.141] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName="CloudStore", cAlternateFileName="CLOUDS~1")) returned 1 [0264.141] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0264.141] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.141] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0264.141] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0264.141] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0264.141] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0264.142] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.142] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0264.142] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0264.142] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0264.142] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0264.142] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.142] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0264.142] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0264.142] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName="Recent", cAlternateFileName="")) returned 1 [0264.142] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0264.144] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.144] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0264.144] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0264.144] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e656464, dwReserved1=0x74696d63, cFileName="SendTo", cAlternateFileName="")) returned 1 [0264.144] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0264.147] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.147] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x7c, dwReserved1=0x40221d, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0264.147] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0264.148] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0264.148] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0264.148] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0264.150] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22e [0264.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0264.150] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0264.252] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x22e, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x22e, lpOverlapped=0x0) returned 1 [0264.253] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x22e, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x22e, lpOverlapped=0x0) returned 1 [0264.254] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.289] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.305] CloseHandle (hObject=0x1fc) returned 1 [0264.305] CloseHandle (hObject=0x1e8) returned 1 [0264.305] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.z49-css-qhb")) returned 0 [0264.306] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.z49-css-qhb")) returned 0x20 [0264.306] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e2908 [0264.307] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0264.307] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0264.307] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0264.308] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0xffffffff [0264.308] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 1 [0264.309] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0264.309] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0264.310] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x458 [0264.310] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0264.310] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0264.413] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x458, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x458, lpOverlapped=0x0) returned 1 [0264.415] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x458, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x458, lpOverlapped=0x0) returned 1 [0264.416] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.459] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.475] CloseHandle (hObject=0x1e8) returned 1 [0264.475] CloseHandle (hObject=0x1fc) returned 1 [0264.475] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.z49-css-qhb")) returned 0 [0264.476] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.z49-css-qhb")) returned 0x20 [0264.476] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 0x7e2688 [0264.476] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 0 [0264.476] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0264.476] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0264.477] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0xffffffff [0264.477] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0264.477] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0264.477] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0264.478] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6552206c, dwReserved1=0x69706963, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0264.478] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0264.478] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0264.478] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="Programs", cAlternateFileName="")) returned 1 [0264.478] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0264.480] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.480] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e055fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0264.480] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e055fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0264.481] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e055fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0264.481] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0264.482] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0264.482] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0264.485] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x238 [0264.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0264.486] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0264.582] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x238, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x238, lpOverlapped=0x0) returned 1 [0264.597] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x238, lpOverlapped=0x0) returned 1 [0264.599] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.645] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.666] CloseHandle (hObject=0x1f0) returned 1 [0264.666] CloseHandle (hObject=0x200) returned 1 [0264.666] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.z49-css-qhb")) returned 0 [0264.667] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.z49-css-qhb")) returned 0x20 [0264.667] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2a88 [0264.667] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0264.668] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0264.668] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 1 [0264.669] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 0xffffffff [0264.669] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0264.670] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0264.670] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0264.672] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x452 [0264.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0264.672] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0264.800] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x452, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x452, lpOverlapped=0x0) returned 1 [0264.806] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x452, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x452, lpOverlapped=0x0) returned 1 [0264.807] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.839] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.852] CloseHandle (hObject=0x200) returned 1 [0264.852] CloseHandle (hObject=0x1f0) returned 1 [0264.852] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.z49-css-qhb")) returned 0 [0264.853] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.z49-css-qhb")) returned 0x20 [0264.853] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0x7e2a48 [0264.853] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0 [0264.853] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0264.853] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk")) returned 1 [0264.854] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk")) returned 0xffffffff [0264.854] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0264.854] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0264.855] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0264.855] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x454 [0264.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0264.855] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0264.944] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x454, lpOverlapped=0x0) returned 1 [0264.946] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x454, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x454, lpOverlapped=0x0) returned 1 [0264.947] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.980] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.996] CloseHandle (hObject=0x1f0) returned 1 [0264.997] CloseHandle (hObject=0x200) returned 1 [0264.997] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.z49-css-qhb")) returned 0 [0264.998] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.z49-css-qhb")) returned 0x20 [0264.998] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0x7e2508 [0264.998] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0 [0264.998] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0264.999] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk")) returned 1 [0265.000] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk")) returned 0xffffffff [0265.000] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4382ea4e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4382ea4e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 1 [0265.001] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0265.001] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0265.008] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x452 [0265.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0265.009] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0265.174] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x452, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x452, lpOverlapped=0x0) returned 1 [0265.176] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x452, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x452, lpOverlapped=0x0) returned 1 [0265.178] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.215] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.234] CloseHandle (hObject=0x200) returned 1 [0265.234] CloseHandle (hObject=0x1f0) returned 1 [0265.234] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.z49-css-qhb")) returned 0 [0265.235] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.z49-css-qhb")) returned 0x20 [0265.235] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4382ea4e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4382ea4e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 0x7e2a48 [0265.235] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4382ea4e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4382ea4e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 0 [0265.236] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0265.236] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk")) returned 1 [0265.236] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk")) returned 0xffffffff [0265.236] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4382ea4e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4382ea4e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 0 [0265.236] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0265.237] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726353, dwReserved1=0x4b206e65, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0265.237] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0265.237] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0265.237] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0265.238] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0265.238] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0265.239] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x148 [0265.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0265.240] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0265.329] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x148, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x148, lpOverlapped=0x0) returned 1 [0265.335] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x148, lpOverlapped=0x0) returned 1 [0265.336] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.367] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.381] CloseHandle (hObject=0x1f0) returned 1 [0265.382] CloseHandle (hObject=0x200) returned 1 [0265.382] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.z49-css-qhb")) returned 0 [0265.382] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.z49-css-qhb")) returned 0x20 [0265.382] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e25c8 [0265.383] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0265.383] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0265.383] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0265.384] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0265.384] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543ef5f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6543ef5f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0265.384] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0265.385] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0265.387] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x486 [0265.387] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0265.387] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0265.473] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x486, lpOverlapped=0x0) returned 1 [0265.475] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x486, lpOverlapped=0x0) returned 1 [0265.476] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.506] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.520] CloseHandle (hObject=0x200) returned 1 [0265.520] CloseHandle (hObject=0x1f0) returned 1 [0265.520] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.z49-css-qhb")) returned 0 [0265.521] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.z49-css-qhb")) returned 0x20 [0265.521] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543ef5f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6543ef5f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0x7e2508 [0265.521] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543ef5f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6543ef5f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0265.521] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0265.521] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0265.522] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0xffffffff [0265.522] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543ef5f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6543ef5f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0265.522] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0265.522] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64617065, dwReserved1=0x6b6e6c2e, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0265.522] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0265.522] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0265.523] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0265.523] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0265.523] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0265.525] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0265.525] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0265.525] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0265.682] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0xaa, lpOverlapped=0x0) returned 1 [0265.683] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0xaa, lpOverlapped=0x0) returned 1 [0265.684] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.717] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.733] CloseHandle (hObject=0x1f0) returned 1 [0265.733] CloseHandle (hObject=0x200) returned 1 [0265.734] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.z49-css-qhb")) returned 0 [0265.735] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.z49-css-qhb")) returned 0x20 [0265.735] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e2908 [0265.735] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0265.735] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0265.735] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0265.737] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0265.737] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0265.737] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0265.737] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="Startup", cAlternateFileName="")) returned 1 [0265.737] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0265.737] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0265.737] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 0 [0265.737] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0265.738] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f746b, dwReserved1=0x696e692e, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0265.738] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0265.742] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0265.743] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c063ed7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c063ed7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Command Prompt.lnk", cAlternateFileName="")) returned 1 [0265.743] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0265.744] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0265.745] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x476 [0265.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0265.745] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0265.905] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x476, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x476, lpOverlapped=0x0) returned 1 [0265.908] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x476, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x476, lpOverlapped=0x0) returned 1 [0265.909] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.948] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.963] CloseHandle (hObject=0x200) returned 1 [0265.963] CloseHandle (hObject=0x1f0) returned 1 [0265.963] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.z49-css-qhb")) returned 0 [0265.964] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.z49-css-qhb")) returned 0x20 [0265.964] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c063ed7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c063ed7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Command Prompt.lnk", cAlternateFileName="")) returned 0x7e2548 [0265.964] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c063ed7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c063ed7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Command Prompt.lnk", cAlternateFileName="")) returned 0 [0265.965] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0265.965] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk")) returned 1 [0265.965] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk")) returned 0xffffffff [0265.965] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x90, dwReserved1=0x40221d, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0265.966] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0265.966] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0265.967] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14f [0265.967] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0265.967] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0266.121] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x14f, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x14f, lpOverlapped=0x0) returned 1 [0266.122] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x14f, lpOverlapped=0x0) returned 1 [0266.124] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.157] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.172] CloseHandle (hObject=0x1f0) returned 1 [0266.173] CloseHandle (hObject=0x200) returned 1 [0266.173] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.z49-css-qhb")) returned 0 [0266.174] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.z49-css-qhb")) returned 0x20 [0266.174] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="computer.lnk", cAlternateFileName="")) returned 0x7e2508 [0266.174] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="computer.lnk", cAlternateFileName="")) returned 0 [0266.174] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0266.174] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk")) returned 1 [0266.174] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk")) returned 0xffffffff [0266.175] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Control Panel.lnk", cAlternateFileName="")) returned 1 [0266.175] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0266.175] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0266.177] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x195 [0266.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0266.177] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0266.267] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x195, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x195, lpOverlapped=0x0) returned 1 [0266.268] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x195, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x195, lpOverlapped=0x0) returned 1 [0266.269] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.300] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.313] CloseHandle (hObject=0x200) returned 1 [0266.314] CloseHandle (hObject=0x1f0) returned 1 [0266.314] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.z49-css-qhb")) returned 0 [0266.315] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.z49-css-qhb")) returned 0x20 [0266.315] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Control Panel.lnk", cAlternateFileName="")) returned 0x7e2508 [0266.315] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="Control Panel.lnk", cAlternateFileName="")) returned 0 [0266.315] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0266.315] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk")) returned 1 [0266.315] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk")) returned 0xffffffff [0266.315] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0266.316] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0266.318] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0266.318] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31e [0266.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0266.319] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0266.412] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x31e, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x31e, lpOverlapped=0x0) returned 1 [0266.415] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x31e, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x31e, lpOverlapped=0x0) returned 1 [0266.416] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.444] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.456] CloseHandle (hObject=0x1f0) returned 1 [0266.456] CloseHandle (hObject=0x200) returned 1 [0266.456] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.z49-css-qhb")) returned 0 [0266.457] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.z49-css-qhb")) returned 0x20 [0266.457] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x7e2b08 [0266.457] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0266.457] FindClose (in: hFindFile=0x7e2b08 | out: hFindFile=0x7e2b08) returned 1 [0266.457] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 1 [0266.458] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 0xffffffff [0266.458] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="File Explorer.lnk", cAlternateFileName="")) returned 1 [0266.459] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0266.461] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0266.462] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197 [0266.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0266.462] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0266.535] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x197, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x197, lpOverlapped=0x0) returned 1 [0266.536] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x197, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x197, lpOverlapped=0x0) returned 1 [0266.537] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.563] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.575] CloseHandle (hObject=0x200) returned 1 [0266.576] CloseHandle (hObject=0x1f0) returned 1 [0266.576] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.z49-css-qhb")) returned 0 [0266.576] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.z49-css-qhb")) returned 0x20 [0266.576] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="File Explorer.lnk", cAlternateFileName="")) returned 0x7e26c8 [0266.577] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="File Explorer.lnk", cAlternateFileName="")) returned 0 [0266.577] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0266.577] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk")) returned 1 [0266.577] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk")) returned 0xffffffff [0266.577] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0266.578] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0266.578] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0266.578] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x199 [0266.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0266.579] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0266.727] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x199, lpOverlapped=0x0) returned 1 [0266.728] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x199, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x199, lpOverlapped=0x0) returned 1 [0266.733] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.761] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.773] CloseHandle (hObject=0x1f0) returned 1 [0266.773] CloseHandle (hObject=0x200) returned 1 [0266.774] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.z49-css-qhb")) returned 0 [0266.774] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.z49-css-qhb")) returned 0x20 [0266.774] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Run.lnk", cAlternateFileName="")) returned 0x7e2908 [0266.774] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0266.775] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0266.775] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk")) returned 1 [0266.775] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk")) returned 0xffffffff [0266.775] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0266.775] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0266.775] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b6e6c2e, dwReserved1=0x726f6c70, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0266.775] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0266.855] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0266.855] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.855] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0266.856] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0266.856] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0266.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0266.857] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0266.944] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0xda, lpOverlapped=0x0) returned 1 [0266.948] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0xda, lpOverlapped=0x0) returned 1 [0266.950] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.977] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.990] CloseHandle (hObject=0x200) returned 1 [0266.991] CloseHandle (hObject=0x1f0) returned 1 [0266.991] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.z49-css-qhb")) returned 0 [0267.107] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.z49-css-qhb")) returned 0x20 [0267.107] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2908 [0267.108] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0267.108] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0267.108] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini")) returned 1 [0267.109] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini")) returned 0xffffffff [0267.110] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0267.110] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0267.112] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0267.113] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8bc [0267.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0267.114] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0267.195] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x8bc, lpOverlapped=0x0) returned 1 [0267.208] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8bc, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x8bc, lpOverlapped=0x0) returned 1 [0267.210] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.236] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.255] CloseHandle (hObject=0x1f0) returned 1 [0267.256] CloseHandle (hObject=0x200) returned 1 [0267.256] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.z49-css-qhb")) returned 0 [0267.257] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.z49-css-qhb")) returned 0x20 [0267.257] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x7e2908 [0267.257] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0267.257] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0267.257] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk")) returned 1 [0267.259] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk")) returned 0xffffffff [0267.259] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96df2ecc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96df2ecc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="")) returned 1 [0267.260] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0267.260] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0267.261] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa [0267.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0267.261] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0267.353] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x4fa, lpOverlapped=0x0) returned 1 [0267.372] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x4fa, lpOverlapped=0x0) returned 1 [0267.373] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.406] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.422] CloseHandle (hObject=0x200) returned 1 [0267.422] CloseHandle (hObject=0x1f0) returned 1 [0267.422] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.z49-css-qhb")) returned 0 [0267.423] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.z49-css-qhb")) returned 0x20 [0267.423] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96df2ecc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96df2ecc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="")) returned 0x7e2908 [0267.423] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96df2ecc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96df2ecc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="")) returned 0 [0267.423] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0267.423] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk")) returned 1 [0267.424] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk")) returned 0xffffffff [0267.424] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0xc0, dwReserved1=0x40221d, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="")) returned 1 [0267.425] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0267.425] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0267.425] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa [0267.425] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0267.426] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0267.514] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x4fa, lpOverlapped=0x0) returned 1 [0267.655] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x4fa, lpOverlapped=0x0) returned 1 [0267.656] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.688] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.706] CloseHandle (hObject=0x1f0) returned 1 [0267.706] CloseHandle (hObject=0x200) returned 1 [0267.706] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.z49-css-qhb")) returned 0 [0267.707] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.z49-css-qhb")) returned 0x20 [0267.707] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="")) returned 0x7e2508 [0267.707] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="")) returned 0 [0267.708] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0267.708] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk")) returned 1 [0267.708] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk")) returned 0xffffffff [0267.708] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0267.709] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0267.709] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0267.710] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8bc [0267.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0267.711] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0267.866] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x8bc, lpOverlapped=0x0) returned 1 [0267.881] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8bc, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x8bc, lpOverlapped=0x0) returned 1 [0267.882] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.914] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.930] CloseHandle (hObject=0x200) returned 1 [0267.931] CloseHandle (hObject=0x1f0) returned 1 [0267.931] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.z49-css-qhb")) returned 0 [0267.932] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.z49-css-qhb" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.z49-css-qhb")) returned 0x20 [0267.932] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x88, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x7e2908 [0267.932] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x88, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0267.932] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0267.932] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk")) returned 1 [0267.933] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk")) returned 0xffffffff [0267.934] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0267.934] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0267.934] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b6e6c2e, dwReserved1=0x726f6c70, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0267.934] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0267.934] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x40221d, cFileName="Programs", cAlternateFileName="")) returned 0 [0267.934] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0267.934] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d617267, dwReserved1=0x69706973, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0267.934] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x776f5020, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0267.935] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x776f5020, cFileName="..", cAlternateFileName="")) returned 1 [0267.935] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73776f64, dwReserved1=0x776f5020, cFileName="..", cAlternateFileName="")) returned 0 [0267.935] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0267.935] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d617267, dwReserved1=0x69706973, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0267.935] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0267.935] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7463656e, dwReserved1=0x736e6f69, cFileName="Windows", cAlternateFileName="")) returned 0 [0267.935] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0267.935] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73707041, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0267.935] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0267.935] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61726f70, dwReserved1=0x49207972, cFileName="Roaming", cAlternateFileName="")) returned 0 [0267.935] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0267.935] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x726f7453, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0267.935] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61726f70, dwReserved1=0x49207972, cFileName="Roaming", cAlternateFileName="H,~")) returned 0xffffffff [0267.936] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x726f7453, cFileName="Cookies", cAlternateFileName="")) returned 1 [0267.936] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61726f70, dwReserved1=0x49207972, cFileName="Roaming", cAlternateFileName="H,~")) returned 0xffffffff [0267.936] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x726f7453, cFileName="Desktop", cAlternateFileName="")) returned 1 [0267.936] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0267.936] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.936] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.936] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0267.937] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x726f7453, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0267.937] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0267.939] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.939] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0267.939] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0xa0000003, dwReserved1=0x201, cFileName="", cAlternateFileName="\x88,~")) returned 0xffffffff [0267.940] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0267.940] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0xa0000003, dwReserved1=0x201, cFileName="", cAlternateFileName="\x88,~")) returned 0xffffffff [0267.940] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0267.940] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0xa0000003, dwReserved1=0x201, cFileName="", cAlternateFileName="\x88,~")) returned 0xffffffff [0267.940] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0267.940] FindClose (in: hFindFile=0x7e2c88 | out: hFindFile=0x7e2c88) returned 1 [0267.941] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646956, dwReserved1=0x7365736f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0267.941] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0267.942] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.942] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.942] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0267.942] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646956, dwReserved1=0x7365736f, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0267.942] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0267.943] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.943] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.943] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0267.943] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646956, dwReserved1=0x7365736f, cFileName="Links", cAlternateFileName="")) returned 1 [0267.943] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0267.944] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.944] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.944] FindClose (in: hFindFile=0x7e2688 | out: hFindFile=0x7e2688) returned 1 [0267.944] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7365736f, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0267.944] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.944] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7365736f, cFileName="Music", cAlternateFileName="")) returned 1 [0267.944] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0267.946] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.946] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.946] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0267.946] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7365736f, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0267.946] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.946] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7365736f, cFileName="NetHood", cAlternateFileName="")) returned 1 [0267.946] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.946] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x19fa8eb, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x19fa8eb, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x7365736f, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0267.947] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0267.947] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0267.947] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0267.948] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xac, dwReserved1=0x40221d, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0267.948] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0267.948] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0267.948] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xac, dwReserved1=0x40221d, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0267.948] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0267.949] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30, dwReserved1=0x40221d, cFileName="Pictures", cAlternateFileName="")) returned 1 [0267.949] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0267.949] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.949] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.949] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0267.949] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0267.949] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.949] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Recent", cAlternateFileName="")) returned 1 [0267.949] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.950] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0267.950] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0267.950] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.950] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.950] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0267.950] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="SendTo", cAlternateFileName="")) returned 1 [0267.950] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.950] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0267.950] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.951] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0267.951] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="H,~")) returned 0xffffffff [0267.951] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Videos", cAlternateFileName="")) returned 1 [0267.951] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0267.951] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.951] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 0 [0267.951] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0267.951] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Videos", cAlternateFileName="")) returned 0 [0267.951] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0267.951] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73757365, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0267.951] FindFirstFileA (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="Videos", cAlternateFileName="H'~")) returned 0xffffffff [0267.952] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73757365, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0267.952] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\*.*", lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0267.961] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0267.961] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x40221d, cFileName="AppData", cAlternateFileName="")) returned 1 [0267.961] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0267.962] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.962] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="Local", cAlternateFileName="")) returned 1 [0267.962] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0267.962] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0267.962] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0267.962] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0267.963] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.963] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0267.963] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0267.970] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0267.970] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x3000003, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0267.970] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x7fcd78, ftCreationTime.dwLowDateTime=0x7000020, ftCreationTime.dwHighDateTime=0x201, ftLastAccessTime.dwLowDateTime=0x7d02d0, ftLastAccessTime.dwHighDateTime=0x10001, ftLastWriteTime.dwLowDateTime=0x3c, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x7ffd88, nFileSizeLow=0x181, dwReserved0=0x10001e4, dwReserved1=0x7d00c0, cFileName="", cAlternateFileName="\x08*~")) returned 0xffffffff [0267.971] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x3000003, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0267.971] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0267.971] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0267.972] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0267.972] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0267.972] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0267.972] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="Local", cAlternateFileName="")) returned 0 [0267.972] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0267.972] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0006c61, dwReserved1=0x40221d, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0267.972] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0267.975] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f736f72, dwReserved1=0x49207466, cFileName="..", cAlternateFileName="")) returned 1 [0267.975] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0267.975] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x201, cFileName="", cAlternateFileName="H(~")) returned 0xffffffff [0267.975] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0267.975] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x201, cFileName="", cAlternateFileName="H(~")) returned 0xffffffff [0267.975] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0267.975] FindFirstFileA (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x382, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x7d6418, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x201, cFileName="", cAlternateFileName="H(~")) returned 0xffffffff [0267.975] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x49207466, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0267.975] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0267.976] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0006c61, dwReserved1=0x40221d, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0267.977] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0267.977] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x6e656d75, dwReserved1=0x73757374, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0267.977] CreateFileA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0267.978] CreateFileA (lpFileName="C:\\Users\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\desktop.ini.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e0 [0267.978] GetFileSize (in: hFile=0x1dc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0267.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0267.979] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0268.127] ReadFile (in: hFile=0x1dc, lpBuffer=0x227000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19f7b4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19f7b4*=0xae, lpOverlapped=0x0) returned 1 [0268.128] WriteFile (in: hFile=0x1e0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x19f7b4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19f7b4*=0xae, lpOverlapped=0x0) returned 1 [0268.129] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.161] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.177] CloseHandle (hObject=0x1dc) returned 1 [0268.177] CloseHandle (hObject=0x1e0) returned 1 [0268.177] MoveFileA (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\desktop.ini.z49-css-qhb")) returned 0 [0268.178] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini.z49-css-qhb" (normalized: "c:\\users\\desktop.ini.z49-css-qhb")) returned 0x20 [0268.178] FindFirstFileA (in: lpFileName="C:\\Users\\desktop.ini", lpFindFileData=0x19f6b0 | out: lpFindFileData=0x19f6b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x7fb990, dwReserved1=0x7fb168, cFileName="desktop.ini", cAlternateFileName="")) returned 0x7e2848 [0268.178] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f6b0 | out: lpFindFileData=0x19f6b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x7fb990, dwReserved1=0x7fb168, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0268.178] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0268.179] DeleteFileA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 1 [0268.180] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 0xffffffff [0268.180] FindNextFileA (in: hFindFile=0x7e2748, lpFindFileData=0x19fc1c | out: lpFindFileData=0x19fc1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1024, dwReserved1=0x40221d, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0268.180] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\*.*", lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2688 [0268.180] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.180] FindNextFileA (in: hFindFile=0x7e2688, lpFindFileData=0x19f9b4 | out: lpFindFileData=0x19f9b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0268.181] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*.*", lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName=".", cAlternateFileName="")) returned 0x7e2b08 [0268.181] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="..", cAlternateFileName="")) returned 1 [0268.181] FindNextFileA (in: hFindFile=0x7e2b08, lpFindFileData=0x19f74c | out: lpFindFileData=0x19f74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="Local", cAlternateFileName="")) returned 1 [0268.181] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\*.*", lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c88 [0268.181] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.181] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0268.181] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0268.182] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.182] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0268.182] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0268.182] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0268.182] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0268.183] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.183] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0268.183] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0268.184] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.184] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 1 [0268.184] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0268.523] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.523] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt15.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0268.524] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x24c57, dwReserved0=0x160, dwReserved1=0x40221d, cFileName="AdobeSysFnt15.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0268.524] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x160, dwReserved1=0x40221d, cFileName="Cache", cAlternateFileName="")) returned 1 [0268.525] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0268.529] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0268.529] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x255e, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="AcroFnt15.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0268.529] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x255e, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="AcroFnt15.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0268.529] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0268.536] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7e48a8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7e48a8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x63727ff2, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x746e466f, dwReserved1=0x6c2e3531, cFileName="IconCacheRdr.dat", cAlternateFileName="ICONCA~1.DAT")) returned 1 [0268.536] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0268.537] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0268.562] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6b0 [0268.563] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0268.563] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0268.660] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0xf6b0, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xf6b0, lpOverlapped=0x0) returned 1 [0268.746] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xf6b0, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xf6b0, lpOverlapped=0x0) returned 1 [0268.748] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.779] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.797] CloseHandle (hObject=0x1fc) returned 1 [0268.797] CloseHandle (hObject=0x1e8) returned 1 [0268.798] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.z49-css-qhb")) returned 0 [0268.799] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.z49-css-qhb")) returned 0x20 [0268.799] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7e48a8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7e48a8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x63727ff2, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="IconCacheRdr.dat", cAlternateFileName="ICONCA~1.DAT")) returned 0x7e2b48 [0268.799] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7e48a8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7e48a8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x63727ff2, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="IconCacheRdr.dat", cAlternateFileName="ICONCA~1.DAT")) returned 0 [0268.799] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0268.799] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 1 [0268.801] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 0xffffffff [0268.801] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8995a87, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8995a87, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8995a87, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1aaac, dwReserved0=0x3c, dwReserved1=0x40221d, cFileName="IconCacheRdr65536.dat", cAlternateFileName="ICONCA~2.DAT")) returned 1 [0268.801] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0268.802] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0268.802] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aaac [0268.802] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0268.803] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0268.892] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1aaac, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x1aaac, lpOverlapped=0x0) returned 1 [0268.957] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1aaac, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x1aaac, lpOverlapped=0x0) returned 1 [0268.960] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.990] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.039] CloseHandle (hObject=0x1e8) returned 1 [0269.039] CloseHandle (hObject=0x1fc) returned 1 [0269.039] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.z49-css-qhb")) returned 0 [0269.040] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.z49-css-qhb")) returned 0x20 [0269.040] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8995a87, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8995a87, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8995a87, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1aaac, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="IconCacheRdr65536.dat", cAlternateFileName="ICONCA~2.DAT")) returned 0x7e2c08 [0269.040] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8995a87, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8995a87, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8995a87, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1aaac, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="IconCacheRdr65536.dat", cAlternateFileName="ICONCA~2.DAT")) returned 0 [0269.040] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0269.040] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 1 [0269.042] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 0xffffffff [0269.042] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76642b27, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76642b27, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe8aecfcb, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0269.043] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0269.044] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0269.044] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1400 [0269.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0269.045] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0269.239] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x1400, lpOverlapped=0x0) returned 1 [0269.264] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x1400, lpOverlapped=0x0) returned 1 [0269.265] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.298] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.317] CloseHandle (hObject=0x1fc) returned 1 [0269.317] CloseHandle (hObject=0x1e8) returned 1 [0269.317] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.318] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.318] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76642b27, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76642b27, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe8aecfcb, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 0x7e2508 [0269.318] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76642b27, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76642b27, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe8aecfcb, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 0 [0269.318] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0269.318] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 1 [0269.320] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.320] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.320] CloseHandle (hObject=0xffffffff) returned 1 [0269.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.321] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.321] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.321] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.321] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.321] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.321] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.321] CloseHandle (hObject=0xffffffff) returned 1 [0269.321] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.322] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.322] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.322] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.322] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.322] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.322] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.322] CloseHandle (hObject=0xffffffff) returned 1 [0269.322] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.322] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.323] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.323] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.323] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.323] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.323] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.323] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.323] CloseHandle (hObject=0xffffffff) returned 1 [0269.323] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.323] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.323] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.324] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x88.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.324] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.324] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.324] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.324] CloseHandle (hObject=0xffffffff) returned 1 [0269.324] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.324] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.324] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.324] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.324] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.325] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.325] CloseHandle (hObject=0xffffffff) returned 1 [0269.325] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.325] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.325] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.325] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.325] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.325] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.325] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.325] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.326] CloseHandle (hObject=0xffffffff) returned 1 [0269.326] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.326] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.326] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.326] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.326] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.326] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.326] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.326] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.326] CloseHandle (hObject=0xffffffff) returned 1 [0269.326] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.327] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.327] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.327] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.327] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.327] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.327] CloseHandle (hObject=0xffffffff) returned 1 [0269.327] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.327] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.328] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.328] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.328] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.328] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.328] CloseHandle (hObject=0xffffffff) returned 1 [0269.328] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.328] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.328] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.328] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.329] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.329] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.329] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.329] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.329] CloseHandle (hObject=0xffffffff) returned 1 [0269.329] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.329] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.329] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø.\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.329] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ø.\x07\x02\\/\x07\x02(2@")) returned 0 [0269.329] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.329] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.329] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.330] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.330] CloseHandle (hObject=0xffffffff) returned 1 [0269.330] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.330] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.330] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08/\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.330] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08/\x07\x02\\/\x07\x02(2@")) returned 0 [0269.330] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.330] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.330] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.330] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.331] CloseHandle (hObject=0xffffffff) returned 1 [0269.331] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.331] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.331] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18/\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.331] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18/\x07\x02\\/\x07\x02(2@")) returned 0 [0269.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.331] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.331] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.331] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.331] CloseHandle (hObject=0xffffffff) returned 1 [0269.331] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.332] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.332] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.332] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0269.332] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.332] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.332] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.332] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.332] CloseHandle (hObject=0xffffffff) returned 1 [0269.332] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0 [0269.332] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.z49-css-qhb")) returned 0x20 [0269.332] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0269.333] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0269.333] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.333] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc")) returned 0 [0269.333] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents")) returned 0xffffffff [0269.333] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="ToolsSearchCacheRdr", cAlternateFileName="TOOLSS~1")) returned 1 [0269.333] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0269.333] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.333] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0269.333] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0269.333] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0269.334] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0269.335] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0269.335] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf76f [0269.335] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0269.336] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0269.455] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xf76f, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xf76f, lpOverlapped=0x0) returned 1 [0269.572] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xf76f, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xf76f, lpOverlapped=0x0) returned 1 [0269.661] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.690] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.707] CloseHandle (hObject=0x1e8) returned 1 [0269.707] CloseHandle (hObject=0x1fc) returned 1 [0269.707] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.z49-css-qhb")) returned 0 [0269.708] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.z49-css-qhb")) returned 0x20 [0269.708] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0x7e2708 [0269.709] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0269.709] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0269.709] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 1 [0269.711] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 0xffffffff [0269.711] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0269.711] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0269.711] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0269.711] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0269.712] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCef", cAlternateFileName="")) returned 1 [0269.712] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63614372, dwReserved1=0x622e6568, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0269.712] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63614372, dwReserved1=0x622e6568, cFileName="..", cAlternateFileName="")) returned 1 [0269.712] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63614372, dwReserved1=0x622e6568, cFileName="DC", cAlternateFileName="")) returned 1 [0269.712] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x140, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0269.713] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x140, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0269.713] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x140, dwReserved1=0x40221d, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0269.713] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6a51047, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0269.714] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6a51047, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0269.714] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd780dd5d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="Cache", cAlternateFileName="")) returned 1 [0269.714] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0269.715] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0269.715] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd781529a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd781529a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd781529a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="data_0", cAlternateFileName="")) returned 1 [0269.715] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0269.716] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0269.718] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0269.719] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0269.719] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0269.834] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0269.859] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0269.860] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.891] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.907] CloseHandle (hObject=0x1f0) returned 1 [0269.907] CloseHandle (hObject=0x200) returned 1 [0269.908] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.908] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.908] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd781529a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd781529a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd781529a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_0", cAlternateFileName="")) returned 0x7e2a88 [0269.909] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd781529a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd781529a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd781529a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_0", cAlternateFileName="")) returned 0 [0269.909] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0269.909] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 1 [0269.910] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.910] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.910] CloseHandle (hObject=0xffffffff) returned 1 [0269.910] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.911] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.911] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.911] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x020/\x07\x02(2@")) returned 0 [0269.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.911] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.911] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.911] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.911] CloseHandle (hObject=0xffffffff) returned 1 [0269.911] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.912] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.912] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x020/\x07\x02(2@")) returned 0 [0269.912] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.912] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.912] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.912] CloseHandle (hObject=0xffffffff) returned 1 [0269.912] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.913] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.913] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x020/\x07\x02(2@")) returned 0 [0269.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.913] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.913] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.913] CloseHandle (hObject=0xffffffff) returned 1 [0269.913] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.913] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.914] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x020/\x07\x02(2@")) returned 0 [0269.914] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.914] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.914] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.914] CloseHandle (hObject=0xffffffff) returned 1 [0269.915] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.915] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.915] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.915] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0 [0269.915] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.915] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.915] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.915] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.915] CloseHandle (hObject=0xffffffff) returned 1 [0269.915] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.916] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.916] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.916] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0 [0269.916] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.916] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.916] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.916] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.916] CloseHandle (hObject=0xffffffff) returned 1 [0269.916] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.916] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.916] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.917] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0 [0269.917] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.917] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.917] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.917] CloseHandle (hObject=0xffffffff) returned 1 [0269.917] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.917] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.918] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0 [0269.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.918] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.918] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.918] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.918] CloseHandle (hObject=0xffffffff) returned 1 [0269.918] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.918] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.918] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.918] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x020/\x07\x02(2@")) returned 0 [0269.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.919] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.919] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.919] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.919] CloseHandle (hObject=0xffffffff) returned 1 [0269.919] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.919] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.919] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.919] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x020/\x07\x02(2@")) returned 0 [0269.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.919] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.920] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.920] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.920] CloseHandle (hObject=0xffffffff) returned 1 [0269.920] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.920] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.920] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.920] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x020/\x07\x02(2@")) returned 0 [0269.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.920] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.920] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.921] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.921] CloseHandle (hObject=0xffffffff) returned 1 [0269.921] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.921] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.921] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.921] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x020/\x07\x02(2@")) returned 0 [0269.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.921] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.921] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.921] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.922] CloseHandle (hObject=0xffffffff) returned 1 [0269.922] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.922] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.922] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.922] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x020/\x07\x02(2@")) returned 0 [0269.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.922] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.922] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.923] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.923] CloseHandle (hObject=0xffffffff) returned 1 [0269.923] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.923] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.924] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.924] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x020/\x07\x02(2@")) returned 0 [0269.924] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.924] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.924] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.924] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.924] CloseHandle (hObject=0xffffffff) returned 1 [0269.924] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0 [0269.924] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.z49-css-qhb")) returned 0x20 [0269.924] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x020/\x07\x02(2@")) returned 0xffffffff [0269.925] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x020/\x07\x02(2@")) returned 0 [0269.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0269.925] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0269.925] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0")) returned 0xffffffff [0269.925] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78179b2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78179b2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8c1e26a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0xb8, dwReserved1=0x40221d, cFileName="data_1", cAlternateFileName="")) returned 1 [0269.926] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0269.926] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0269.926] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42000 [0269.926] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0269.927] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0270.054] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x42000, lpOverlapped=0x0) returned 1 [0270.089] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x42000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x42000, lpOverlapped=0x0) returned 1 [0270.096] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.199] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.214] CloseHandle (hObject=0x200) returned 1 [0270.214] CloseHandle (hObject=0x1f0) returned 1 [0270.215] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.215] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.215] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78179b2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78179b2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8c1e26a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_1", cAlternateFileName="")) returned 0x7e26c8 [0270.216] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78179b2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78179b2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8c1e26a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_1", cAlternateFileName="")) returned 0 [0270.216] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0270.216] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 1 [0270.219] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.219] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.219] CloseHandle (hObject=0xffffffff) returned 1 [0270.219] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.220] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.220] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.220] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.220] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.220] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.220] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.220] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.220] CloseHandle (hObject=0xffffffff) returned 1 [0270.220] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.220] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.220] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.220] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.220] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.221] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.221] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.221] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.221] CloseHandle (hObject=0xffffffff) returned 1 [0270.221] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.221] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.221] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.221] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.221] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.221] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.221] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.221] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.221] CloseHandle (hObject=0xffffffff) returned 1 [0270.221] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.222] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.222] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.222] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.222] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.222] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.222] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.222] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.222] CloseHandle (hObject=0xffffffff) returned 1 [0270.222] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.222] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.222] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.222] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.222] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.222] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.222] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.223] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.223] CloseHandle (hObject=0xffffffff) returned 1 [0270.223] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.223] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.223] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.223] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.223] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.223] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.223] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.223] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.223] CloseHandle (hObject=0xffffffff) returned 1 [0270.223] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.223] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.223] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.224] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.224] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.224] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.224] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.224] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.224] CloseHandle (hObject=0xffffffff) returned 1 [0270.224] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.224] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.224] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.224] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.224] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.224] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.224] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.224] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.224] CloseHandle (hObject=0xffffffff) returned 1 [0270.225] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.225] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.225] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.225] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.225] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.225] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.225] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.225] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.225] CloseHandle (hObject=0xffffffff) returned 1 [0270.225] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.225] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.225] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.225] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.225] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.226] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.226] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.226] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.226] CloseHandle (hObject=0xffffffff) returned 1 [0270.226] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.226] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.226] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.226] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.226] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.226] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.226] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.228] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.228] CloseHandle (hObject=0xffffffff) returned 1 [0270.228] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.228] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.228] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.229] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.229] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.229] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.229] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.229] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.229] CloseHandle (hObject=0xffffffff) returned 1 [0270.229] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.229] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.229] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.229] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.229] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.229] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.229] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.229] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.230] CloseHandle (hObject=0xffffffff) returned 1 [0270.230] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.230] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.230] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.230] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.230] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.230] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.230] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.230] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.230] CloseHandle (hObject=0xffffffff) returned 1 [0270.230] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0 [0270.230] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.z49-css-qhb")) returned 0x20 [0270.230] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.231] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.231] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.231] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.231] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1")) returned 0xffffffff [0270.231] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78215d4, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78215d4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd78215d4, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="data_2", cAlternateFileName="")) returned 1 [0270.231] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0270.232] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0270.232] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0270.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0270.233] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0270.305] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0270.319] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0270.321] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.345] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.358] CloseHandle (hObject=0x1f0) returned 1 [0270.358] CloseHandle (hObject=0x200) returned 1 [0270.358] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.359] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.359] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78215d4, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78215d4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd78215d4, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_2", cAlternateFileName="")) returned 0x7e2a88 [0270.359] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78215d4, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78215d4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd78215d4, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_2", cAlternateFileName="")) returned 0 [0270.359] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0270.359] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 1 [0270.360] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.360] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.360] CloseHandle (hObject=0xffffffff) returned 1 [0270.361] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.361] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.361] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.361] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.361] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.361] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.361] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.361] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.361] CloseHandle (hObject=0xffffffff) returned 1 [0270.361] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.361] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.361] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.362] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.362] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.362] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.362] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.362] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.362] CloseHandle (hObject=0xffffffff) returned 1 [0270.362] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.362] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.362] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.362] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.362] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.362] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.362] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.362] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.363] CloseHandle (hObject=0xffffffff) returned 1 [0270.363] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.363] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.363] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.363] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.363] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.363] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.363] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.363] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.363] CloseHandle (hObject=0xffffffff) returned 1 [0270.363] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.363] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.363] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.364] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.364] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.364] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.364] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.364] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.364] CloseHandle (hObject=0xffffffff) returned 1 [0270.364] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.364] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.364] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.364] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.364] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.364] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.364] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.364] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.364] CloseHandle (hObject=0xffffffff) returned 1 [0270.365] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.365] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.365] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.365] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.365] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.365] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.365] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.365] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.365] CloseHandle (hObject=0xffffffff) returned 1 [0270.365] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.365] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.365] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.365] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.365] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.366] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.366] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.366] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.366] CloseHandle (hObject=0xffffffff) returned 1 [0270.366] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.366] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.366] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.366] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.366] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.366] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.366] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.366] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.366] CloseHandle (hObject=0xffffffff) returned 1 [0270.366] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.367] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.367] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.367] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.367] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.367] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.367] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.368] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.368] CloseHandle (hObject=0xffffffff) returned 1 [0270.368] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.368] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.368] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.368] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.368] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.368] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.368] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.368] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.369] CloseHandle (hObject=0xffffffff) returned 1 [0270.369] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.369] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.369] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.369] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.369] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.369] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.369] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.369] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.369] CloseHandle (hObject=0xffffffff) returned 1 [0270.369] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.369] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.369] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.370] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.370] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.370] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.370] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.370] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.370] CloseHandle (hObject=0xffffffff) returned 1 [0270.370] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.370] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.370] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.370] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.370] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.370] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.370] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.370] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.370] CloseHandle (hObject=0xffffffff) returned 1 [0270.371] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0 [0270.371] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.z49-css-qhb")) returned 0x20 [0270.371] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.371] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.371] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.371] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.371] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2")) returned 0xffffffff [0270.371] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7823d0a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd7823d0a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xb8, dwReserved1=0x40221d, cFileName="data_3", cAlternateFileName="")) returned 1 [0270.372] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0270.372] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0270.372] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0270.372] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0270.373] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0270.451] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0270.468] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0270.470] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.501] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.517] CloseHandle (hObject=0x200) returned 1 [0270.517] CloseHandle (hObject=0x1f0) returned 1 [0270.518] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.518] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.518] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7823d0a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd7823d0a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_3", cAlternateFileName="")) returned 0x7e2bc8 [0270.519] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7823d0a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd7823d0a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="data_3", cAlternateFileName="")) returned 0 [0270.519] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0270.519] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 1 [0270.520] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.520] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.520] CloseHandle (hObject=0xffffffff) returned 1 [0270.520] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.520] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.520] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.521] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.521] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.521] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.521] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.521] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.521] CloseHandle (hObject=0xffffffff) returned 1 [0270.521] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.521] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.521] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.522] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.522] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.522] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.522] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.522] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.522] CloseHandle (hObject=0xffffffff) returned 1 [0270.522] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.522] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.522] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.522] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.522] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.523] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.523] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.523] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.523] CloseHandle (hObject=0xffffffff) returned 1 [0270.523] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.523] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.523] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.523] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10.\x07\x02À-\x07\x02(2@")) returned 0 [0270.523] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.523] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.524] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.524] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.524] CloseHandle (hObject=0xffffffff) returned 1 [0270.524] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.524] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.524] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.524] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.524] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.524] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.524] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.524] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.525] CloseHandle (hObject=0xffffffff) returned 1 [0270.525] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.525] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.525] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.525] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.525] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.525] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.525] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.525] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.525] CloseHandle (hObject=0xffffffff) returned 1 [0270.525] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.526] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.526] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.526] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.526] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.526] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.526] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.526] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.526] CloseHandle (hObject=0xffffffff) returned 1 [0270.526] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.526] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.527] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.527] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.527] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.527] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.527] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.527] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.527] CloseHandle (hObject=0xffffffff) returned 1 [0270.527] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.527] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.527] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.528] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.528] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.528] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.528] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.528] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.528] CloseHandle (hObject=0xffffffff) returned 1 [0270.528] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.528] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.528] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.528] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.528] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.528] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.529] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.529] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.529] CloseHandle (hObject=0xffffffff) returned 1 [0270.529] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.529] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.529] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.529] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.529] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.529] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.529] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.529] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.530] CloseHandle (hObject=0xffffffff) returned 1 [0270.530] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.530] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.530] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.530] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.530] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.530] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.530] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.530] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.531] CloseHandle (hObject=0xffffffff) returned 1 [0270.531] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.531] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.531] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.531] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.531] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.531] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.531] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.531] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.531] CloseHandle (hObject=0xffffffff) returned 1 [0270.531] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.532] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.532] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.532] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.532] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.532] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.532] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.532] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.532] CloseHandle (hObject=0xffffffff) returned 1 [0270.532] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0 [0270.532] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.z49-css-qhb")) returned 0x20 [0270.532] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.532] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.533] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.533] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.533] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3")) returned 0xffffffff [0270.533] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="index", cAlternateFileName="")) returned 1 [0270.533] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0270.533] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0270.534] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80170 [0270.534] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0270.535] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0270.613] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x80170, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x80170, lpOverlapped=0x0) returned 1 [0270.693] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x80170, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x80170, lpOverlapped=0x0) returned 1 [0270.707] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.741] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.754] CloseHandle (hObject=0x1f0) returned 1 [0270.754] CloseHandle (hObject=0x200) returned 1 [0270.754] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.755] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.755] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="index", cAlternateFileName="")) returned 0x7e2b88 [0270.755] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x7d8320, dwReserved1=0x7d8d90, cFileName="index", cAlternateFileName="")) returned 0 [0270.755] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0270.755] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 1 [0270.766] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.766] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.766] CloseHandle (hObject=0xffffffff) returned 1 [0270.766] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.766] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.766] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.767] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä-\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.767] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.767] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.767] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.767] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.767] CloseHandle (hObject=0xffffffff) returned 1 [0270.768] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.768] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.768] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.768] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô-\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.768] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.768] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.768] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.768] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.769] CloseHandle (hObject=0xffffffff) returned 1 [0270.769] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.769] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.769] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.769] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04.\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.770] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.770] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.770] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.770] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.770] CloseHandle (hObject=0xffffffff) returned 1 [0270.770] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.770] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.770] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.770] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.771] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.771] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.771] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.771] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.771] CloseHandle (hObject=0xffffffff) returned 1 [0270.771] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.771] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.771] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.772] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.772] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.772] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.772] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.772] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.772] CloseHandle (hObject=0xffffffff) returned 1 [0270.772] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.772] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.773] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.773] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.773] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.773] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.773] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.773] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.773] CloseHandle (hObject=0xffffffff) returned 1 [0270.773] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.773] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.773] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.774] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.774] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.774] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.774] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.774] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.774] CloseHandle (hObject=0xffffffff) returned 1 [0270.774] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.774] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.775] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.775] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.775] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.775] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.775] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.775] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.775] CloseHandle (hObject=0xffffffff) returned 1 [0270.775] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.775] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.775] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.775] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.776] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.776] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.776] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.776] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.776] CloseHandle (hObject=0xffffffff) returned 1 [0270.776] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.776] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.776] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.777] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.777] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.777] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.777] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.777] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.777] CloseHandle (hObject=0xffffffff) returned 1 [0270.777] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.777] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.777] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.778] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.778] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.778] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.778] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.778] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.778] CloseHandle (hObject=0xffffffff) returned 1 [0270.778] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.779] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.779] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.780] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.780] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.780] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.780] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.780] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.780] CloseHandle (hObject=0xffffffff) returned 1 [0270.780] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.781] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.781] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.781] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.781] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.781] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.781] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.781] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.781] CloseHandle (hObject=0xffffffff) returned 1 [0270.781] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.781] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.781] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.782] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.782] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.782] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.782] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.782] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.782] CloseHandle (hObject=0xffffffff) returned 1 [0270.783] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0 [0270.783] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.z49-css-qhb")) returned 0x20 [0270.783] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02\x8c/\x07\x02(2@")) returned 0xffffffff [0270.784] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02\x8c/\x07\x02(2@")) returned 0 [0270.784] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.784] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache")) returned 0 [0270.784] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index")) returned 0xffffffff [0270.784] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="index", cAlternateFileName="")) returned 0 [0270.784] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0270.784] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x337865, dwReserved1=0x3000003, cFileName="Cookie", cAlternateFileName="")) returned 1 [0270.784] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0270.784] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0270.785] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd7437f7e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xb8, dwReserved1=0x40221d, cFileName="Cookies", cAlternateFileName="")) returned 1 [0270.785] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0270.786] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0270.787] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c00 [0270.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0270.787] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0270.868] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x1c00, lpOverlapped=0x0) returned 1 [0270.870] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x1c00, lpOverlapped=0x0) returned 1 [0270.871] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.895] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.909] CloseHandle (hObject=0x200) returned 1 [0270.909] CloseHandle (hObject=0x1f0) returned 1 [0270.910] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.910] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.911] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd7437f7e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="Cookies", cAlternateFileName="")) returned 0x7e25c8 [0270.911] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd7437f7e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="Cookies", cAlternateFileName="")) returned 0 [0270.911] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0270.911] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 1 [0270.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.912] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.912] CloseHandle (hObject=0xffffffff) returned 1 [0270.912] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.913] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.913] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0 [0270.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.913] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.913] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.913] CloseHandle (hObject=0xffffffff) returned 1 [0270.913] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.913] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.913] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0 [0270.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.913] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.914] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.914] CloseHandle (hObject=0xffffffff) returned 1 [0270.914] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.914] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.914] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0 [0270.914] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.914] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.914] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.914] CloseHandle (hObject=0xffffffff) returned 1 [0270.914] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.915] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.915] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.915] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14.\x07\x02À-\x07\x02(2@")) returned 0 [0270.915] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.915] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.915] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.915] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.915] CloseHandle (hObject=0xffffffff) returned 1 [0270.915] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.915] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.915] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.915] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.915] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.915] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.916] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.916] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.916] CloseHandle (hObject=0xffffffff) returned 1 [0270.916] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.916] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.916] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.916] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.916] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.916] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.916] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.916] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.916] CloseHandle (hObject=0xffffffff) returned 1 [0270.916] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.917] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.917] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.917] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.917] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.917] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.917] CloseHandle (hObject=0xffffffff) returned 1 [0270.917] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.917] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.917] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.918] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.918] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.918] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.918] CloseHandle (hObject=0xffffffff) returned 1 [0270.918] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.918] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.918] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.918] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.918] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.918] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.918] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.919] CloseHandle (hObject=0xffffffff) returned 1 [0270.919] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.919] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.919] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.919] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.919] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.919] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.919] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.919] CloseHandle (hObject=0xffffffff) returned 1 [0270.919] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.919] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.920] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.920] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.920] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.920] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.920] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.920] CloseHandle (hObject=0xffffffff) returned 1 [0270.920] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.920] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.920] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.920] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.921] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.921] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.921] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.921] CloseHandle (hObject=0xffffffff) returned 1 [0270.921] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.921] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.921] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.921] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.921] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.921] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.922] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.922] CloseHandle (hObject=0xffffffff) returned 1 [0270.922] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.922] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.922] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.922] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.922] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.922] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.923] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0270.923] CloseHandle (hObject=0xffffffff) returned 1 [0270.923] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0 [0270.923] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.z49-css-qhb")) returned 0x20 [0270.923] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02À-\x07\x02(2@")) returned 0xffffffff [0270.923] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02À-\x07\x02(2@")) returned 0 [0270.923] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0270.923] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0270.923] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies")) returned 0xffffffff [0270.923] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd74f6b1c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0270.924] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0270.924] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0271.076] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0271.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0271.077] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0271.196] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x0, lpOverlapped=0x0) returned 1 [0271.196] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.226] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.238] CloseHandle (hObject=0x1f0) returned 1 [0271.238] CloseHandle (hObject=0x200) returned 1 [0271.238] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.239] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.239] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd74f6b1c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0x7e2a48 [0271.239] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd74f6b1c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0 [0271.239] FindClose (in: hFindFile=0x7e2a48 | out: hFindFile=0x7e2a48) returned 1 [0271.239] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 1 [0271.240] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.240] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.240] CloseHandle (hObject=0xffffffff) returned 1 [0271.240] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.240] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.240] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="L/\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.240] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="L/\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.240] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.240] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.241] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.241] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.241] CloseHandle (hObject=0xffffffff) returned 1 [0271.241] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.241] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.241] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="L/\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.241] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="L/\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.241] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.241] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.241] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.241] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.242] CloseHandle (hObject=0xffffffff) returned 1 [0271.242] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.242] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.242] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\/\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.242] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\/\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.242] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.242] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.242] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.242] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.242] CloseHandle (hObject=0xffffffff) returned 1 [0271.242] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.242] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.243] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="l/\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.243] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="l/\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.243] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.243] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.243] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.243] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.243] CloseHandle (hObject=0xffffffff) returned 1 [0271.243] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.243] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.243] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="|/\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.243] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="|/\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.243] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.243] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.244] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.244] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.244] CloseHandle (hObject=0xffffffff) returned 1 [0271.244] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.244] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.244] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c/\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.244] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c/\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.244] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.244] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.244] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.244] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.245] CloseHandle (hObject=0xffffffff) returned 1 [0271.245] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.245] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.245] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.245] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.245] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.245] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.245] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.245] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.245] CloseHandle (hObject=0xffffffff) returned 1 [0271.245] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.246] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.246] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.246] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.246] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.246] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.246] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.246] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.246] CloseHandle (hObject=0xffffffff) returned 1 [0271.246] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.246] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.246] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.247] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.247] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.247] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.247] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.247] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.247] CloseHandle (hObject=0xffffffff) returned 1 [0271.247] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.247] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.247] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.247] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.247] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.247] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.247] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.248] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.248] CloseHandle (hObject=0xffffffff) returned 1 [0271.248] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.248] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.248] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.248] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.248] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.248] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.248] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.248] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.248] CloseHandle (hObject=0xffffffff) returned 1 [0271.248] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.249] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.249] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.249] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.249] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.249] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.249] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.249] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.249] CloseHandle (hObject=0xffffffff) returned 1 [0271.249] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.249] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.249] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.249] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.250] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.250] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.250] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.250] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.250] CloseHandle (hObject=0xffffffff) returned 1 [0271.250] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.250] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.252] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c#\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.252] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c#\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.252] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.252] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.252] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.252] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0271.252] CloseHandle (hObject=0xffffffff) returned 1 [0271.252] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0 [0271.253] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.z49-css-qhb")) returned 0x20 [0271.253] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x1c#\x07\x02\x84\"\x07\x02(2@")) returned 0xffffffff [0271.253] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x1c#\x07\x02\x84\"\x07\x02(2@")) returned 0 [0271.253] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0271.253] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie")) returned 0 [0271.253] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal")) returned 0xffffffff [0271.253] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd74f6b1c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0 [0271.253] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0271.253] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x337865, dwReserved1=0x3000003, cFileName="Cookie", cAlternateFileName="")) returned 0 [0271.253] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0271.253] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x140, dwReserved1=0x40221d, cFileName="Acrobat", cAlternateFileName="")) returned 0 [0271.253] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0271.253] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63614372, dwReserved1=0x622e6568, cFileName="DC", cAlternateFileName="")) returned 0 [0271.254] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0271.254] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0271.254] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461626f, dwReserved1=0x622e6568, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0271.254] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461626f, dwReserved1=0x622e6568, cFileName="..", cAlternateFileName="")) returned 1 [0271.254] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73de0392, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73e065fe, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x7461626f, dwReserved1=0x622e6568, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0271.255] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Profiles", cAlternateFileName="")) returned 1 [0271.255] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65696b, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0271.255] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65696b, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0271.256] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d479e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d479e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d479e6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x65696b, dwReserved1=0x40221d, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0271.256] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0271.257] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0271.257] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102a0 [0271.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0271.258] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0271.330] ReadFile (in: hFile=0x1fc, lpBuffer=0x227000c, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0x102a0, lpOverlapped=0x0) returned 1 [0271.407] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x102a0, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0x102a0, lpOverlapped=0x0) returned 1 [0271.409] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.435] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.448] CloseHandle (hObject=0x1fc) returned 1 [0271.448] CloseHandle (hObject=0x1e8) returned 1 [0271.448] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.z49-css-qhb")) returned 0 [0271.449] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.z49-css-qhb")) returned 0x20 [0271.449] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d479e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d479e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d479e6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="wscRGB.icc", cAlternateFileName="")) returned 0x7e2c08 [0271.449] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d479e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d479e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d479e6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="wscRGB.icc", cAlternateFileName="")) returned 0 [0271.449] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0271.449] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 1 [0271.450] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0xffffffff [0271.451] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d6dc69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0271.451] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0271.452] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0271.452] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa74 [0271.452] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0271.453] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0271.529] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e944*=0xa74, lpOverlapped=0x0) returned 1 [0271.531] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa74, lpNumberOfBytesWritten=0x19e944, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e944*=0xa74, lpOverlapped=0x0) returned 1 [0271.532] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.558] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.571] CloseHandle (hObject=0x1e8) returned 1 [0271.571] CloseHandle (hObject=0x1fc) returned 1 [0271.571] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.z49-css-qhb")) returned 0 [0271.572] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.z49-css-qhb")) returned 0x20 [0271.572] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d6dc69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0x7e2708 [0271.572] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d6dc69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x7d85c8, dwReserved1=0x7ed0f8, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0271.572] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0271.572] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 1 [0271.573] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0xffffffff [0271.573] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d6dc69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0271.573] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0271.573] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Profiles", cAlternateFileName="")) returned 0 [0271.573] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0271.573] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0271.574] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0271.574] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0271.574] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="\x88,~")) returned 0xffffffff [0271.574] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CEF", cAlternateFileName="")) returned 1 [0271.574] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x2e313173, cFileName=".", cAlternateFileName="")) returned 0x7e2608 [0271.574] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x2e313173, cFileName="..", cAlternateFileName="")) returned 1 [0271.574] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x2e313173, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0271.575] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0271.575] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName="..", cAlternateFileName="")) returned 1 [0271.575] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0271.575] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\Dictionaries\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0271.575] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.575] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0271.575] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0271.575] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0271.575] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0271.576] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6966, dwReserved1=0x2e313173, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0271.576] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0271.576] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61442072, dwReserved1=0x6174, cFileName="Comms", cAlternateFileName="")) returned 1 [0271.576] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f6974, dwReserved1=0x65697261, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0271.577] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f6974, dwReserved1=0x65697261, cFileName="..", cAlternateFileName="")) returned 1 [0271.577] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f6974, dwReserved1=0x65697261, cFileName="Temp", cAlternateFileName="")) returned 1 [0271.577] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0271.579] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName="..", cAlternateFileName="")) returned 1 [0271.579] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e43986b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0271.580] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0271.582] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0271.583] GetFileSize (in: hFile=0x1f4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14 [0271.583] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0271.583] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0271.707] ReadFile (in: hFile=0x1f4, lpBuffer=0x227000c, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19ebac*=0x14, lpOverlapped=0x0) returned 1 [0271.708] WriteFile (in: hFile=0x1fc, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x19ebac, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19ebac*=0x14, lpOverlapped=0x0) returned 1 [0271.709] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.736] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.749] CloseHandle (hObject=0x1f4) returned 1 [0271.749] CloseHandle (hObject=0x1fc) returned 1 [0271.749] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat.z49-css-qhb")) returned 0 [0271.750] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat.z49-css-qhb")) returned 0x20 [0271.750] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat", lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e43986b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 0x7e2848 [0271.750] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eaa8 | out: lpFindFileData=0x19eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e43986b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x7d8690, dwReserved1=0x7fa160, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 0 [0271.750] FindClose (in: hFindFile=0x7e2848 | out: hFindFile=0x7e2848) returned 1 [0271.751] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat")) returned 1 [0271.752] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\temp\\calendarcache.dat")) returned 0xffffffff [0271.752] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e43986b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x692e4247, dwReserved1=0x636363, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 0 [0271.752] FindClose (in: hFindFile=0x7e2c08 | out: hFindFile=0x7e2c08) returned 1 [0271.752] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61646e65, dwReserved1=0x63614372, cFileName="Unistore", cAlternateFileName="")) returned 1 [0271.752] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0271.752] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0271.753] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="data", cAlternateFileName="")) returned 1 [0271.753] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0271.754] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.754] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92842523, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92842523, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe5af4421, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AggregateCache.uca", cAlternateFileName="AGGREG~1.UCA")) returned 1 [0271.755] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92842523, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92842523, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe5af4421, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AggregateCache.uca", cAlternateFileName="AGGREG~1.UCA")) returned 0 [0271.755] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0271.755] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="data", cAlternateFileName="")) returned 0 [0271.755] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0271.755] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61646e61, dwReserved1=0x63614372, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0271.755] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x1a672446, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61676572, dwReserved1=0x61436574, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0271.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x1a672446, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61676572, dwReserved1=0x61436574, cFileName="..", cAlternateFileName="")) returned 1 [0271.767] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bfe5114, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6bfe5114, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1a541366, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x61676572, dwReserved1=0x61436574, cFileName="store.jfm", cAlternateFileName="")) returned 1 [0271.768] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46f4d81c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46f4d81c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1a5b3b2e, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xd80000, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="store.vol", cAlternateFileName="")) returned 1 [0271.768] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c293b35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c293b35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc120a166, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="USS.jcp", cAlternateFileName="")) returned 1 [0271.768] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c1163b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1a4363d1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="USS.jtx", cAlternateFileName="")) returned 1 [0271.768] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a62b13, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46a62b13, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x46a62b13, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0271.769] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a62b13, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46a62b13, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x46a62b13, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0271.769] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c221427, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6c221427, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="USStmp.jtx", cAlternateFileName="")) returned 1 [0271.769] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c221427, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6c221427, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="USStmp.jtx", cAlternateFileName="")) returned 0 [0271.769] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0271.770] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61646e61, dwReserved1=0x63614372, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0271.770] FindClose (in: hFindFile=0x7e2a08 | out: hFindFile=0x7e2a08) returned 1 [0271.770] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f7473, dwReserved1=0x424465, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1 [0271.770] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e706d74, dwReserved1=0x3278746a, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0271.770] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e706d74, dwReserved1=0x3278746a, cFileName="..", cAlternateFileName="")) returned 1 [0271.770] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x2e706d74, dwReserved1=0x3278746a, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 1 [0271.771] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x2e706d74, dwReserved1=0x3278746a, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 0 [0271.771] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0271.771] FindNextFileA (in: hFindFile=0x7e2c88, lpFindFileData=0x19f4e4 | out: lpFindFileData=0x19f4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x626f6c47, dwReserved1=0x65536c61, cFileName="Google", cAlternateFileName="")) returned 1 [0271.771] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*.*", lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2a48 [0271.771] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0271.771] FindNextFileA (in: hFindFile=0x7e2a48, lpFindFileData=0x19f27c | out: lpFindFileData=0x19f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="Chrome", cAlternateFileName="")) returned 1 [0271.771] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c08 [0271.771] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0271.771] FindNextFileA (in: hFindFile=0x7e2c08, lpFindFileData=0x19f014 | out: lpFindFileData=0x19f014*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0271.771] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2a08 [0271.774] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0271.774] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0271.774] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0271.774] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0271.774] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 0 [0271.774] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0271.775] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0271.775] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0271.775] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="..", cAlternateFileName="")) returned 1 [0271.775] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="metadata", cAlternateFileName="")) returned 1 [0271.775] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0271.776] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0271.776] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0271.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0271.777] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0271.951] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x0, lpOverlapped=0x0) returned 1 [0271.951] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.983] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.998] CloseHandle (hObject=0x1e8) returned 1 [0271.998] CloseHandle (hObject=0x200) returned 1 [0271.998] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0271.999] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0271.999] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="metadata", cAlternateFileName="")) returned 0x7e2c48 [0271.999] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="metadata", cAlternateFileName="")) returned 0 [0271.999] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0271.999] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 1 [0272.000] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.001] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.001] CloseHandle (hObject=0xffffffff) returned 1 [0272.001] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.001] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.001] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.001] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0 [0272.001] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.001] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.002] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.002] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.002] CloseHandle (hObject=0xffffffff) returned 1 [0272.002] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.002] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.002] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.002] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0 [0272.002] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.002] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.002] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.002] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.003] CloseHandle (hObject=0xffffffff) returned 1 [0272.003] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.003] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.003] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.003] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0 [0272.003] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.003] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.003] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.003] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.003] CloseHandle (hObject=0xffffffff) returned 1 [0272.004] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.004] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.004] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h-\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.004] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h-\x07\x02ä.\x07\x02(2@")) returned 0 [0272.004] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.004] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.004] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.004] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.004] CloseHandle (hObject=0xffffffff) returned 1 [0272.004] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.005] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.005] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.005] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0 [0272.005] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.005] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.005] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.005] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.005] CloseHandle (hObject=0xffffffff) returned 1 [0272.005] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.005] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.005] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.006] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0 [0272.006] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.006] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.006] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.006] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.006] CloseHandle (hObject=0xffffffff) returned 1 [0272.006] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.006] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.006] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.007] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì,\x07\x02ä.\x07\x02(2@")) returned 0 [0272.007] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.007] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.007] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.007] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.007] CloseHandle (hObject=0xffffffff) returned 1 [0272.007] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.007] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.007] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.007] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.007] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.008] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.008] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.008] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.008] CloseHandle (hObject=0xffffffff) returned 1 [0272.008] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.008] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.008] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.008] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.008] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.008] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.009] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.009] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.009] CloseHandle (hObject=0xffffffff) returned 1 [0272.009] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.009] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.009] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.009] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.009] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.009] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.009] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.009] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.010] CloseHandle (hObject=0xffffffff) returned 1 [0272.010] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.010] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.010] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.010] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.010] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.010] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.010] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.010] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.010] CloseHandle (hObject=0xffffffff) returned 1 [0272.010] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.011] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.011] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.011] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.011] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.011] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.011] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.011] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.011] CloseHandle (hObject=0xffffffff) returned 1 [0272.011] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.011] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.012] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.012] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.012] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.012] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.012] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.012] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.012] CloseHandle (hObject=0xffffffff) returned 1 [0272.012] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.012] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.012] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.013] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.013] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.013] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.013] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.013] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.013] CloseHandle (hObject=0xffffffff) returned 1 [0272.013] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0 [0272.013] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.z49-css-qhb")) returned 0x20 [0272.013] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¬\"\x07\x02ä.\x07\x02(2@")) returned 0xffffffff [0272.013] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¬\"\x07\x02ä.\x07\x02(2@")) returned 0 [0272.013] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.014] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad")) returned 0 [0272.014] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0xffffffff [0272.014] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x40221d, cFileName="reports", cAlternateFileName="")) returned 1 [0272.014] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0272.014] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.014] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0272.014] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0272.014] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x64, dwReserved1=0x40221d, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0272.015] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0272.015] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0272.022] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28 [0272.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0272.023] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0272.188] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x28, lpOverlapped=0x0) returned 1 [0272.189] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x28, lpOverlapped=0x0) returned 1 [0272.190] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.230] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.249] CloseHandle (hObject=0x200) returned 1 [0272.249] CloseHandle (hObject=0x1e8) returned 1 [0272.249] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.z49-css-qhb")) returned 0 [0272.250] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.z49-css-qhb")) returned 0x20 [0272.250] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="settings.dat", cAlternateFileName="")) returned 0x7e2a88 [0272.250] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0272.250] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0272.250] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1 [0272.252] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0xffffffff [0272.252] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x64, dwReserved1=0x40221d, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0272.252] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0272.252] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a8a90d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe6ef52bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe6f1b526, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x676e6974, dwReserved1=0x61642e73, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~2.PMA")) returned 1 [0272.253] FindNextFileA (in: hFindFile=0x7e2a08, lpFindFileData=0x19edac | out: lpFindFileData=0x19edac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c2e339, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa82ac98, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa82ac98, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Default", cAlternateFileName="")) returned 1 [0272.253] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c2e339, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa82ac98, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa82ac98, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2848 [0272.296] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c2e339, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa82ac98, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa82ac98, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0272.436] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="Cache", cAlternateFileName="")) returned 1 [0272.436] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0272.438] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.438] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172faf1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172faf1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1 [0272.439] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0272.439] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0272.447] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb000 [0272.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0272.448] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0272.544] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0xb000, lpOverlapped=0x0) returned 1 [0272.650] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xb000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0xb000, lpOverlapped=0x0) returned 1 [0272.653] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.686] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.703] CloseHandle (hObject=0x200) returned 1 [0272.703] CloseHandle (hObject=0x1f0) returned 1 [0272.704] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.705] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.705] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172faf1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172faf1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_0", cAlternateFileName="")) returned 0x7e2888 [0272.705] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172faf1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172faf1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_0", cAlternateFileName="")) returned 0 [0272.705] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0272.705] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 1 [0272.707] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.707] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.707] CloseHandle (hObject=0xffffffff) returned 1 [0272.707] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.707] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.708] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`-\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.708] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="`-\x07\x02|/\x07\x02(2@")) returned 0 [0272.708] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.708] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.708] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.708] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.708] CloseHandle (hObject=0xffffffff) returned 1 [0272.708] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.708] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.709] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.709] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.709] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.709] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.709] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.709] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.709] CloseHandle (hObject=0xffffffff) returned 1 [0272.709] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.709] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.710] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.710] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.710] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.710] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.710] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.711] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.711] CloseHandle (hObject=0xffffffff) returned 1 [0272.711] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.711] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.711] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.711] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.711] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.712] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.712] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.713] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.713] CloseHandle (hObject=0xffffffff) returned 1 [0272.713] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.713] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.713] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.713] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.713] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.713] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.713] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.714] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.714] CloseHandle (hObject=0xffffffff) returned 1 [0272.714] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.714] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.714] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.714] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.714] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.714] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.714] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.714] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.714] CloseHandle (hObject=0xffffffff) returned 1 [0272.715] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.715] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.715] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.715] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.715] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.715] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.715] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.715] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.715] CloseHandle (hObject=0xffffffff) returned 1 [0272.715] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.716] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.716] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.716] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.716] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.716] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.716] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.716] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.716] CloseHandle (hObject=0xffffffff) returned 1 [0272.716] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.716] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.717] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.717] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.717] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.717] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.717] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.717] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.717] CloseHandle (hObject=0xffffffff) returned 1 [0272.717] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.717] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.717] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.718] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.718] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.718] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.718] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.718] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.718] CloseHandle (hObject=0xffffffff) returned 1 [0272.718] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.718] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.718] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.719] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.719] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.719] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.719] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.719] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.719] CloseHandle (hObject=0xffffffff) returned 1 [0272.719] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.719] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.719] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.719] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.719] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.720] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.720] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.720] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.720] CloseHandle (hObject=0xffffffff) returned 1 [0272.720] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.720] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.720] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.720] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.720] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.720] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.721] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.721] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.721] CloseHandle (hObject=0xffffffff) returned 1 [0272.721] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.721] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.721] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.721] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02|/\x07\x02(2@")) returned 0 [0272.721] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.721] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.721] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.722] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.722] CloseHandle (hObject=0xffffffff) returned 1 [0272.722] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0 [0272.722] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.z49-css-qhb")) returned 0x20 [0272.722] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02|/\x07\x02(2@")) returned 0xffffffff [0272.722] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02|/\x07\x02(2@")) returned 0 [0272.722] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.722] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.722] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0xffffffff [0272.722] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="data_1", cAlternateFileName="")) returned 1 [0272.723] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0272.723] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0272.724] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42000 [0272.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0272.724] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0272.826] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x42000, lpOverlapped=0x0) returned 1 [0272.885] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x42000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x42000, lpOverlapped=0x0) returned 1 [0272.892] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.928] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.943] CloseHandle (hObject=0x1f0) returned 1 [0272.944] CloseHandle (hObject=0x200) returned 1 [0272.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.945] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_1", cAlternateFileName="")) returned 0x7e2508 [0272.946] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_1", cAlternateFileName="")) returned 0 [0272.946] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0272.946] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 1 [0272.950] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.950] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.950] CloseHandle (hObject=0xffffffff) returned 1 [0272.950] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.951] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.951] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t/\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.951] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="t/\x07\x02L-\x07\x02(2@")) returned 0 [0272.951] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.951] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.951] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.951] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.951] CloseHandle (hObject=0xffffffff) returned 1 [0272.951] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.952] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.952] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.952] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.952] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.952] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.952] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.952] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.952] CloseHandle (hObject=0xffffffff) returned 1 [0272.952] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.953] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.953] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.953] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.953] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.953] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.953] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.953] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.953] CloseHandle (hObject=0xffffffff) returned 1 [0272.953] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.954] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.954] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.954] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.954] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.954] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.954] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.954] CloseHandle (hObject=0xffffffff) returned 1 [0272.954] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.954] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.955] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.955] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.955] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.955] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.955] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.955] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.955] CloseHandle (hObject=0xffffffff) returned 1 [0272.955] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.955] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.955] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.956] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.956] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.956] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.956] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.956] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.956] CloseHandle (hObject=0xffffffff) returned 1 [0272.956] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.956] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.956] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.956] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.956] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.956] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.957] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.957] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.957] CloseHandle (hObject=0xffffffff) returned 1 [0272.957] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.957] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.957] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.957] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.957] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.957] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.957] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.957] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.958] CloseHandle (hObject=0xffffffff) returned 1 [0272.958] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.958] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.958] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.958] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.958] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.958] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.958] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.958] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.958] CloseHandle (hObject=0xffffffff) returned 1 [0272.959] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.959] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.959] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.959] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.959] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.959] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.959] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.959] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.959] CloseHandle (hObject=0xffffffff) returned 1 [0272.959] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.959] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.960] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.960] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.960] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.965] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.965] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.965] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.965] CloseHandle (hObject=0xffffffff) returned 1 [0272.965] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.965] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.966] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.966] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.966] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.966] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.966] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.966] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.966] CloseHandle (hObject=0xffffffff) returned 1 [0272.966] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.966] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.966] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.967] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.967] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.967] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.967] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.967] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.967] CloseHandle (hObject=0xffffffff) returned 1 [0272.967] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.967] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.967] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.967] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02L-\x07\x02(2@")) returned 0 [0272.967] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.967] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.968] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.968] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0272.968] CloseHandle (hObject=0xffffffff) returned 1 [0272.968] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0 [0272.968] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.z49-css-qhb")) returned 0x20 [0272.968] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0272.968] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02L-\x07\x02(2@")) returned 0 [0272.968] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0272.968] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0272.968] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0xffffffff [0272.969] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="data_2", cAlternateFileName="")) returned 1 [0272.969] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0272.970] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0272.971] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0272.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0272.971] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0273.079] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0273.089] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x2000, lpOverlapped=0x0) returned 1 [0273.090] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.168] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.184] CloseHandle (hObject=0x200) returned 1 [0273.184] CloseHandle (hObject=0x1f0) returned 1 [0273.184] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.185] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.185] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_2", cAlternateFileName="")) returned 0x7e2908 [0273.185] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_2", cAlternateFileName="")) returned 0 [0273.185] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0273.185] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 1 [0273.187] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.187] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.187] CloseHandle (hObject=0xffffffff) returned 1 [0273.187] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.187] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.187] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="L-\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.188] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="L-\x07\x02è.\x07\x02(2@")) returned 0 [0273.188] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.188] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.188] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.188] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.188] CloseHandle (hObject=0xffffffff) returned 1 [0273.188] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.188] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.189] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.189] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.189] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.189] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.189] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.189] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.189] CloseHandle (hObject=0xffffffff) returned 1 [0273.189] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.189] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.189] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.190] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.190] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.190] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.190] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.190] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.190] CloseHandle (hObject=0xffffffff) returned 1 [0273.190] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.190] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.190] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.191] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.191] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.191] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.191] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.191] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.191] CloseHandle (hObject=0xffffffff) returned 1 [0273.191] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.191] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.191] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.191] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.191] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.192] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.192] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.192] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.192] CloseHandle (hObject=0xffffffff) returned 1 [0273.192] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.192] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.192] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.192] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.192] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.192] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.193] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.193] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.193] CloseHandle (hObject=0xffffffff) returned 1 [0273.193] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.193] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.193] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.193] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.193] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.193] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.193] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.194] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.194] CloseHandle (hObject=0xffffffff) returned 1 [0273.194] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.194] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.194] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.194] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.195] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.195] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.195] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.195] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.195] CloseHandle (hObject=0xffffffff) returned 1 [0273.195] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.195] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.195] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.195] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.195] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.195] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.196] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.196] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.196] CloseHandle (hObject=0xffffffff) returned 1 [0273.196] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.196] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.196] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.196] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.196] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.196] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.196] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.197] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.197] CloseHandle (hObject=0xffffffff) returned 1 [0273.197] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.197] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.197] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.197] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.197] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.197] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.197] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.197] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.198] CloseHandle (hObject=0xffffffff) returned 1 [0273.198] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.198] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.198] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.198] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.198] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.198] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.198] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.198] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.198] CloseHandle (hObject=0xffffffff) returned 1 [0273.199] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.199] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.199] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.199] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.199] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.199] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.199] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.199] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.199] CloseHandle (hObject=0xffffffff) returned 1 [0273.199] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.200] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.200] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.200] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02è.\x07\x02(2@")) returned 0 [0273.200] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.200] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.200] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.200] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.200] CloseHandle (hObject=0xffffffff) returned 1 [0273.200] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0 [0273.201] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.z49-css-qhb")) returned 0x20 [0273.201] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0273.201] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02è.\x07\x02(2@")) returned 0 [0273.201] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.201] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.201] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0xffffffff [0273.201] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x40, dwReserved1=0x40221d, cFileName="data_3", cAlternateFileName="")) returned 1 [0273.202] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0273.202] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0273.203] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x402000 [0273.203] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0273.203] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0273.287] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x402000, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x402000, lpOverlapped=0x0) returned 1 [0273.426] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x402000, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x402000, lpOverlapped=0x0) returned 1 [0273.557] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.581] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.593] CloseHandle (hObject=0x1f0) returned 1 [0273.593] CloseHandle (hObject=0x200) returned 1 [0273.593] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.594] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.594] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_3", cAlternateFileName="")) returned 0x7e25c8 [0273.594] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517321bc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517321bc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa76c10c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="data_3", cAlternateFileName="")) returned 0 [0273.594] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0273.594] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 1 [0273.596] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.596] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.596] CloseHandle (hObject=0xffffffff) returned 1 [0273.596] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.596] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.596] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="L/\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.596] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="L/\x07\x02L-\x07\x02(2@")) returned 0 [0273.596] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.596] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.597] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.597] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.597] CloseHandle (hObject=0xffffffff) returned 1 [0273.597] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.597] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.597] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.597] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.597] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.597] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.597] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.597] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.597] CloseHandle (hObject=0xffffffff) returned 1 [0273.597] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.597] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.598] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.598] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.598] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.598] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.598] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.598] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.598] CloseHandle (hObject=0xffffffff) returned 1 [0273.598] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.598] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.598] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.598] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.598] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.598] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.598] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.599] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.599] CloseHandle (hObject=0xffffffff) returned 1 [0273.599] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.599] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.599] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.599] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.599] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.599] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.599] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.599] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.599] CloseHandle (hObject=0xffffffff) returned 1 [0273.599] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.599] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.599] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.600] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.600] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.600] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.600] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.600] CloseHandle (hObject=0xffffffff) returned 1 [0273.600] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.600] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.600] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.600] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.600] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.600] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.602] CloseHandle (hObject=0xffffffff) returned 1 [0273.602] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.602] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.602] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.602] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.602] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.602] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.602] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.603] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.603] CloseHandle (hObject=0xffffffff) returned 1 [0273.603] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.603] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.603] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.603] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.603] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.603] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.603] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.603] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.603] CloseHandle (hObject=0xffffffff) returned 1 [0273.603] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.603] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.603] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.604] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.604] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.604] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.604] CloseHandle (hObject=0xffffffff) returned 1 [0273.604] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.604] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.604] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.604] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.604] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.605] CloseHandle (hObject=0xffffffff) returned 1 [0273.605] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.605] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.605] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.605] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.605] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.605] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.605] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.605] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.605] CloseHandle (hObject=0xffffffff) returned 1 [0273.605] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.605] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.605] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.606] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02L-\x07\x02(2@")) returned 0 [0273.606] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.606] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.606] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.606] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.606] CloseHandle (hObject=0xffffffff) returned 1 [0273.606] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.606] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.606] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.606] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02L-\x07\x02(2@")) returned 0 [0273.606] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.606] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.606] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.606] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.606] CloseHandle (hObject=0xffffffff) returned 1 [0273.607] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0 [0273.607] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.z49-css-qhb")) returned 0x20 [0273.607] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0273.607] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02L-\x07\x02(2@")) returned 0 [0273.607] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.607] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.607] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0xffffffff [0273.607] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5172faf1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="index", cAlternateFileName="")) returned 1 [0273.608] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0273.608] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0273.608] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80170 [0273.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0273.609] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0273.704] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x80170, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x80170, lpOverlapped=0x0) returned 1 [0273.863] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x80170, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x80170, lpOverlapped=0x0) returned 1 [0273.875] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.909] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.924] CloseHandle (hObject=0x200) returned 1 [0273.924] CloseHandle (hObject=0x1f0) returned 1 [0273.925] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.925] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.926] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5172faf1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="index", cAlternateFileName="")) returned 0x7e2b88 [0273.926] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5172faf1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="index", cAlternateFileName="")) returned 0 [0273.926] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0273.926] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 1 [0273.934] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.934] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.934] CloseHandle (hObject=0xffffffff) returned 1 [0273.934] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.934] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.934] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="L-\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.935] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="L-\x07\x02\\/\x07\x02(2@")) returned 0 [0273.935] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.935] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.935] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.935] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.935] CloseHandle (hObject=0xffffffff) returned 1 [0273.935] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.935] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.936] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.936] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.936] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.936] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.936] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.936] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.936] CloseHandle (hObject=0xffffffff) returned 1 [0273.936] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.936] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.937] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.937] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.937] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.937] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.937] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.937] CloseHandle (hObject=0xffffffff) returned 1 [0273.937] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.938] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.938] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.938] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.938] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.938] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.938] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.938] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.938] CloseHandle (hObject=0xffffffff) returned 1 [0273.938] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.939] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.939] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.939] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.939] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.939] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.939] CloseHandle (hObject=0xffffffff) returned 1 [0273.939] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.940] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.940] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.940] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.940] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.940] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.940] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.940] CloseHandle (hObject=0xffffffff) returned 1 [0273.940] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.940] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.940] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.941] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.941] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.941] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.941] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.941] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.941] CloseHandle (hObject=0xffffffff) returned 1 [0273.941] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.941] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.941] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.941] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.942] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.942] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.942] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.942] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.942] CloseHandle (hObject=0xffffffff) returned 1 [0273.942] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.942] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.942] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.942] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.942] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.942] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.943] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.943] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.943] CloseHandle (hObject=0xffffffff) returned 1 [0273.943] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.943] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.943] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.943] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.943] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.943] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.943] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.943] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.944] CloseHandle (hObject=0xffffffff) returned 1 [0273.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.944] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.944] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.944] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.944] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.944] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.944] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.945] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.945] CloseHandle (hObject=0xffffffff) returned 1 [0273.945] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.945] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.945] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ø\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.945] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.945] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.945] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.945] CloseHandle (hObject=0xffffffff) returned 1 [0273.946] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.946] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.946] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.946] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.946] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.946] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.946] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.946] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.946] CloseHandle (hObject=0xffffffff) returned 1 [0273.946] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.947] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.947] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.947] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ø\"\x07\x02\\/\x07\x02(2@")) returned 0 [0273.947] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.947] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.947] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.947] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.947] CloseHandle (hObject=0xffffffff) returned 1 [0273.947] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0 [0273.947] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.z49-css-qhb")) returned 0x20 [0273.948] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02\\/\x07\x02(2@")) returned 0xffffffff [0273.948] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x08#\x07\x02\\/\x07\x02(2@")) returned 0 [0273.948] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0273.948] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache")) returned 0 [0273.948] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0xffffffff [0273.948] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5172faf1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="index", cAlternateFileName="")) returned 0 [0273.948] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0273.948] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295d523, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295d523, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa98218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x337865, dwReserved1=0x40221d, cFileName="Cookies", cAlternateFileName="")) returned 1 [0273.949] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0273.950] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0273.950] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0273.950] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0273.951] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0274.049] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x7000, lpOverlapped=0x0) returned 1 [0274.075] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x7000, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x7000, lpOverlapped=0x0) returned 1 [0274.077] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.100] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.112] CloseHandle (hObject=0x1e8) returned 1 [0274.113] CloseHandle (hObject=0x1f0) returned 1 [0274.113] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.114] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.114] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295d523, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295d523, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa98218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="Cookies", cAlternateFileName="")) returned 0x7e2ac8 [0274.114] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295d523, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295d523, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa98218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x7fb9e0, dwReserved1=0x7fed88, cFileName="Cookies", cAlternateFileName="")) returned 0 [0274.114] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0274.114] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 1 [0274.115] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.115] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.115] CloseHandle (hObject=0xffffffff) returned 1 [0274.115] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.116] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.116] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.116] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0 [0274.116] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.116] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.116] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.116] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.116] CloseHandle (hObject=0xffffffff) returned 1 [0274.116] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.117] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.117] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.117] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0 [0274.117] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.117] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.117] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.117] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.117] CloseHandle (hObject=0xffffffff) returned 1 [0274.117] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.118] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.118] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.118] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0 [0274.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.118] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.118] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.118] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.118] CloseHandle (hObject=0xffffffff) returned 1 [0274.118] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.118] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.118] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.118] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð.\x07\x02\\-\x07\x02(2@")) returned 0 [0274.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.118] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.118] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.119] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.119] CloseHandle (hObject=0xffffffff) returned 1 [0274.119] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.119] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.119] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä.\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.119] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä.\x07\x02\\-\x07\x02(2@")) returned 0 [0274.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.119] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.119] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.119] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.119] CloseHandle (hObject=0xffffffff) returned 1 [0274.119] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.119] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.119] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô.\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.120] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô.\x07\x02\\-\x07\x02(2@")) returned 0 [0274.120] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.120] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.120] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.120] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.120] CloseHandle (hObject=0xffffffff) returned 1 [0274.120] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.120] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.120] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.120] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.120] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.120] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.120] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.120] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.121] CloseHandle (hObject=0xffffffff) returned 1 [0274.121] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.121] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.121] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.121] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.121] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.121] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.121] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.121] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.121] CloseHandle (hObject=0xffffffff) returned 1 [0274.121] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.121] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.121] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.121] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.122] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.122] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.122] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.122] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.122] CloseHandle (hObject=0xffffffff) returned 1 [0274.122] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.122] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.122] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.122] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.122] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.122] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.122] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.122] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.122] CloseHandle (hObject=0xffffffff) returned 1 [0274.122] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.123] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.123] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.123] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.123] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.123] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.123] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.123] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.123] CloseHandle (hObject=0xffffffff) returned 1 [0274.123] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.123] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.123] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.123] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x98\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.123] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.123] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.124] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.124] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.124] CloseHandle (hObject=0xffffffff) returned 1 [0274.124] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.124] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.124] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.124] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¨\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.124] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.124] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.124] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.124] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.124] CloseHandle (hObject=0xffffffff) returned 1 [0274.124] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.124] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.125] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.125] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="¸\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.125] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.125] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.125] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.125] CloseHandle (hObject=0xffffffff) returned 1 [0274.125] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0 [0274.125] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies.z49-css-qhb")) returned 0x20 [0274.125] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\\-\x07\x02(2@")) returned 0xffffffff [0274.125] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="È\"\x07\x02\\-\x07\x02(2@")) returned 0 [0274.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.125] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.125] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0xffffffff [0274.126] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295fc2f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295fc2f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa9ce7a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe4, dwReserved1=0x40221d, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0274.126] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0274.127] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0274.128] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0274.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0274.128] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0274.260] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x0, lpOverlapped=0x0) returned 1 [0274.260] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.304] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.316] CloseHandle (hObject=0x1f0) returned 1 [0274.316] CloseHandle (hObject=0x1e8) returned 1 [0274.316] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.317] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.317] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295fc2f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295fc2f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa9ce7a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0x7e2a88 [0274.317] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295fc2f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295fc2f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa9ce7a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 0 [0274.317] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0274.317] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 1 [0274.317] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.317] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.317] CloseHandle (hObject=0xffffffff) returned 1 [0274.317] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.317] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.318] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.318] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.318] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.318] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.318] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.318] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.318] CloseHandle (hObject=0xffffffff) returned 1 [0274.318] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.318] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.318] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.318] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.318] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.318] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.318] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.319] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.319] CloseHandle (hObject=0xffffffff) returned 1 [0274.319] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.319] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.319] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.319] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.319] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.319] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.319] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.319] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.320] CloseHandle (hObject=0xffffffff) returned 1 [0274.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.320] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.320] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.320] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\\-\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.320] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.320] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.320] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.320] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.320] CloseHandle (hObject=0xffffffff) returned 1 [0274.320] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.320] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.320] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.321] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.321] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.321] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.321] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.321] CloseHandle (hObject=0xffffffff) returned 1 [0274.321] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.321] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.321] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.321] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.321] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.321] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.321] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.321] CloseHandle (hObject=0xffffffff) returned 1 [0274.321] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.322] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.322] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.322] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.322] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.322] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.322] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.322] CloseHandle (hObject=0xffffffff) returned 1 [0274.322] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.322] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.322] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.322] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.323] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.323] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.323] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.323] CloseHandle (hObject=0xffffffff) returned 1 [0274.323] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.323] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.323] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.323] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.323] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.323] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.323] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.323] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.323] CloseHandle (hObject=0xffffffff) returned 1 [0274.323] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.324] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.324] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.324] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.324] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.324] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.324] CloseHandle (hObject=0xffffffff) returned 1 [0274.324] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.324] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.324] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.324] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.324] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.324] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.325] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.325] CloseHandle (hObject=0xffffffff) returned 1 [0274.325] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.325] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.325] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.325] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.325] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.325] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.325] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.325] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.325] CloseHandle (hObject=0xffffffff) returned 1 [0274.325] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.326] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.326] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.326] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.326] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.326] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.326] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.326] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.326] CloseHandle (hObject=0xffffffff) returned 1 [0274.326] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.327] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.327] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.327] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.327] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.327] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.327] CloseHandle (hObject=0xffffffff) returned 1 [0274.327] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0 [0274.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.z49-css-qhb")) returned 0x20 [0274.328] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x02\x18/\x07\x02(2@")) returned 0xffffffff [0274.328] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x02\x18/\x07\x02(2@")) returned 0 [0274.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.328] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.328] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal")) returned 0xffffffff [0274.328] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8be630f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa6610ba, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x70, dwReserved1=0x40221d, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0274.329] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0274.330] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0274.330] GetFileSize (in: hFile=0x1e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x212 [0274.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0274.331] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0274.427] ReadFile (in: hFile=0x1e8, lpBuffer=0x227000c, nNumberOfBytesToRead=0x212, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x212, lpOverlapped=0x0) returned 1 [0274.431] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x212, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x212, lpOverlapped=0x0) returned 1 [0274.433] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.462] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.482] CloseHandle (hObject=0x1e8) returned 1 [0274.482] CloseHandle (hObject=0x1f0) returned 1 [0274.482] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.483] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.483] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8be630f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa6610ba, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 0x7e2608 [0274.483] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8be630f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa6610ba, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 0 [0274.483] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0274.483] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 1 [0274.485] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.485] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.485] CloseHandle (hObject=0xffffffff) returned 1 [0274.485] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.485] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.485] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.485] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02p.\x07\x02(2@")) returned 0 [0274.485] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.486] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.486] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.486] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.486] CloseHandle (hObject=0xffffffff) returned 1 [0274.486] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.486] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.486] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="`/\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.486] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="`/\x07\x02p.\x07\x02(2@")) returned 0 [0274.486] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.486] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.487] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.487] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.487] CloseHandle (hObject=0xffffffff) returned 1 [0274.487] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.487] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.487] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="p/\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.487] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="p/\x07\x02p.\x07\x02(2@")) returned 0 [0274.487] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.487] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.487] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.488] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.488] CloseHandle (hObject=0xffffffff) returned 1 [0274.488] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.488] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.488] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80/\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.488] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80/\x07\x02p.\x07\x02(2@")) returned 0 [0274.488] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.488] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.488] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.488] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.489] CloseHandle (hObject=0xffffffff) returned 1 [0274.489] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.489] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.489] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x90/\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.489] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x90/\x07\x02p.\x07\x02(2@")) returned 0 [0274.489] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.489] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.489] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.489] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.489] CloseHandle (hObject=0xffffffff) returned 1 [0274.490] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.490] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.490] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.490] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.490] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.490] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.490] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.490] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.490] CloseHandle (hObject=0xffffffff) returned 1 [0274.490] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.491] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.491] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.491] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.491] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.491] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.491] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.491] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.492] CloseHandle (hObject=0xffffffff) returned 1 [0274.492] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.492] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.492] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.492] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.492] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.492] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.492] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.492] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.492] CloseHandle (hObject=0xffffffff) returned 1 [0274.493] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.493] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.493] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.493] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.493] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.493] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.493] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.493] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.493] CloseHandle (hObject=0xffffffff) returned 1 [0274.493] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.494] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.494] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.494] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.494] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.494] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.494] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.494] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.494] CloseHandle (hObject=0xffffffff) returned 1 [0274.494] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.494] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.495] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.495] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02p.\x07\x02(2@")) returned 0 [0274.495] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.495] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.495] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.495] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.495] CloseHandle (hObject=0xffffffff) returned 1 [0274.495] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.495] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.495] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.496] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02p.\x07\x02(2@")) returned 0 [0274.496] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.496] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.496] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.496] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.496] CloseHandle (hObject=0xffffffff) returned 1 [0274.496] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.496] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.496] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.496] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.496] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.497] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.497] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.497] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.497] CloseHandle (hObject=0xffffffff) returned 1 [0274.497] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.497] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.497] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.497] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.497] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.497] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.497] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.498] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.498] CloseHandle (hObject=0xffffffff) returned 1 [0274.498] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0 [0274.498] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session.z49-css-qhb")) returned 0x20 [0274.498] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0274.498] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x6, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d4a18, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x02p.\x07\x02(2@")) returned 0 [0274.498] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.498] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.498] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0xffffffff [0274.498] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5776f89b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa7b85d6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa7b85d6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0274.499] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0274.500] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0274.500] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0274.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0274.501] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0274.613] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e6dc*=0x16a, lpOverlapped=0x0) returned 1 [0274.623] WriteFile (in: hFile=0x1e8, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x19e6dc, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e6dc*=0x16a, lpOverlapped=0x0) returned 1 [0274.624] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.670] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.688] CloseHandle (hObject=0x1f0) returned 1 [0274.688] CloseHandle (hObject=0x1e8) returned 1 [0274.688] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.689] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.689] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5776f89b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa7b85d6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa7b85d6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 0x7e2648 [0274.689] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5776f89b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa7b85d6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa7b85d6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 0 [0274.690] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0274.690] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 1 [0274.691] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.691] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.691] CloseHandle (hObject=0xffffffff) returned 1 [0274.691] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.691] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.691] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.692] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0 [0274.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.692] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.692] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.692] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.692] CloseHandle (hObject=0xffffffff) returned 1 [0274.692] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.692] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.692] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.692] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0 [0274.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.693] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.693] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.693] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.693] CloseHandle (hObject=0xffffffff) returned 1 [0274.693] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.693] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.693] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.693] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0 [0274.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.693] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.693] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.694] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.694] CloseHandle (hObject=0xffffffff) returned 1 [0274.694] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.694] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.694] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.694] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô.\x07\x024/\x07\x02(2@")) returned 0 [0274.694] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.694] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.694] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.695] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.695] CloseHandle (hObject=0xffffffff) returned 1 [0274.695] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.695] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.695] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.695] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0 [0274.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.695] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.695] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.695] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.696] CloseHandle (hObject=0xffffffff) returned 1 [0274.696] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.696] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.696] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.696] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0 [0274.696] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.696] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.696] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.696] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.696] CloseHandle (hObject=0xffffffff) returned 1 [0274.696] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.697] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.697] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.697] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0 [0274.697] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.697] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.697] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.697] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.697] CloseHandle (hObject=0xffffffff) returned 1 [0274.697] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.697] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.697] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.698] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0 [0274.698] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.698] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.698] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.698] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.698] CloseHandle (hObject=0xffffffff) returned 1 [0274.698] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.698] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.698] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.699] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0 [0274.699] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.699] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.699] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.699] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.699] CloseHandle (hObject=0xffffffff) returned 1 [0274.699] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.699] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.699] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.699] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84\"\x07\x024/\x07\x02(2@")) returned 0 [0274.699] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.699] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.700] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.700] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.700] CloseHandle (hObject=0xffffffff) returned 1 [0274.700] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.700] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.700] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.700] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x024/\x07\x02(2@")) returned 0 [0274.700] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.700] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.700] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.700] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.701] CloseHandle (hObject=0xffffffff) returned 1 [0274.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.701] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.701] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.701] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x024/\x07\x02(2@")) returned 0 [0274.701] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.701] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.701] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.701] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.701] CloseHandle (hObject=0xffffffff) returned 1 [0274.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.702] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.702] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x024/\x07\x02(2@")) returned 0 [0274.702] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.702] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.702] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.702] CloseHandle (hObject=0xffffffff) returned 1 [0274.702] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.703] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.703] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x024/\x07\x02(2@")) returned 0 [0274.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.703] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.703] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.703] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0274.703] CloseHandle (hObject=0xffffffff) returned 1 [0274.703] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0 [0274.703] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.z49-css-qhb")) returned 0x20 [0274.703] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs", lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x024/\x07\x02(2@")) returned 0xffffffff [0274.704] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e5d8 | out: lpFindFileData=0x19e5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x1d, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1d, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x024/\x07\x02(2@")) returned 0 [0274.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0274.704] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default")) returned 0 [0274.704] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0xffffffff [0274.704] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5179d880, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76dafa5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76dafa5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0274.704] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5179d880, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76dafa5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76dafa5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0274.706] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5179d880, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76dafa5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76dafa5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.706] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000005.log", cAlternateFileName="")) returned 1 [0274.706] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0274.707] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0274.712] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0274.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0274.713] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0274.883] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x0, lpOverlapped=0x0) returned 1 [0274.884] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.938] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.966] CloseHandle (hObject=0x1f0) returned 1 [0274.966] CloseHandle (hObject=0x200) returned 1 [0274.966] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log.z49-css-qhb")) returned 0 [0274.967] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log.z49-css-qhb")) returned 0x20 [0274.967] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="000005.log", cAlternateFileName="")) returned 0x7e2b48 [0274.967] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d84d8, dwReserved1=0x7ee100, cFileName="000005.log", cAlternateFileName="")) returned 0 [0274.967] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0274.967] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log")) returned 1 [0274.968] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000005.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000005.log")) returned 0xffffffff [0274.968] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5192b8e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76b4d40, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76b4d40, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0274.969] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0274.970] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0274.970] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0274.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0274.971] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0275.077] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x10, lpOverlapped=0x0) returned 1 [0275.078] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x10, lpOverlapped=0x0) returned 1 [0275.080] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.122] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.194] CloseHandle (hObject=0x200) returned 1 [0275.194] CloseHandle (hObject=0x1f0) returned 1 [0275.196] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.197] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.197] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5192b8e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76b4d40, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76b4d40, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="CURRENT", cAlternateFileName="")) returned 0x7e2508 [0275.197] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5192b8e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76b4d40, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76b4d40, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0275.197] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0275.197] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 1 [0275.199] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.199] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.199] CloseHandle (hObject=0xffffffff) returned 1 [0275.199] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.199] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.199] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.199] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.199] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.200] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.200] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.200] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.200] CloseHandle (hObject=0xffffffff) returned 1 [0275.200] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.200] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.200] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.200] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.200] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.200] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.201] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.201] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.201] CloseHandle (hObject=0xffffffff) returned 1 [0275.201] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.201] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.201] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.201] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.201] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.201] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.201] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.202] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.202] CloseHandle (hObject=0xffffffff) returned 1 [0275.202] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.202] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.202] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.202] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.202] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.202] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.202] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.202] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.203] CloseHandle (hObject=0xffffffff) returned 1 [0275.203] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.203] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.203] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.203] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.203] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.203] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.203] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.203] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.203] CloseHandle (hObject=0xffffffff) returned 1 [0275.203] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.204] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.204] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.204] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.204] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.204] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.204] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.204] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.204] CloseHandle (hObject=0xffffffff) returned 1 [0275.204] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.204] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.205] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.205] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02p.\x07\x02(2@")) returned 0 [0275.205] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.205] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.205] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.205] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.205] CloseHandle (hObject=0xffffffff) returned 1 [0275.205] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.205] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.205] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0275.206] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0275.206] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.206] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.206] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.206] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.206] CloseHandle (hObject=0xffffffff) returned 1 [0275.206] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.206] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.206] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0275.206] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0275.207] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.207] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.207] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.207] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.207] CloseHandle (hObject=0xffffffff) returned 1 [0275.207] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.207] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.207] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.207] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02p.\x07\x02(2@")) returned 0 [0275.207] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.207] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.208] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.208] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.208] CloseHandle (hObject=0xffffffff) returned 1 [0275.208] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.208] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.208] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.208] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02p.\x07\x02(2@")) returned 0 [0275.208] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.208] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.208] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.209] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.209] CloseHandle (hObject=0xffffffff) returned 1 [0275.209] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.209] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.209] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="0#\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.209] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="0#\x07\x02p.\x07\x02(2@")) returned 0 [0275.209] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.209] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.209] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.210] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.210] CloseHandle (hObject=0xffffffff) returned 1 [0275.210] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.211] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.211] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="@#\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.211] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="@#\x07\x02p.\x07\x02(2@")) returned 0 [0275.211] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.211] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.212] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.212] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.212] CloseHandle (hObject=0xffffffff) returned 1 [0275.212] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.212] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.212] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="P#\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.212] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="P#\x07\x02p.\x07\x02(2@")) returned 0 [0275.212] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.212] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.212] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.213] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.213] CloseHandle (hObject=0xffffffff) returned 1 [0275.213] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0 [0275.213] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.z49-css-qhb")) returned 0x20 [0275.213] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="`#\x07\x02p.\x07\x02(2@")) returned 0xffffffff [0275.213] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="`#\x07\x02p.\x07\x02(2@")) returned 0 [0275.213] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.213] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.213] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0xffffffff [0275.213] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x519291cb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x519291cb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x519291cb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="LOCK", cAlternateFileName="")) returned 1 [0275.214] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0275.215] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0275.216] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0275.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0275.216] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0275.321] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x0, lpOverlapped=0x0) returned 1 [0275.322] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.355] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.371] CloseHandle (hObject=0x1f0) returned 1 [0275.371] CloseHandle (hObject=0x200) returned 1 [0275.371] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.372] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.372] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x519291cb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x519291cb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x519291cb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="LOCK", cAlternateFileName="")) returned 0x7e2888 [0275.372] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x519291cb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x519291cb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x519291cb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="LOCK", cAlternateFileName="")) returned 0 [0275.372] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0275.372] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 1 [0275.373] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.373] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.373] CloseHandle (hObject=0xffffffff) returned 1 [0275.373] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.373] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.373] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.373] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.373] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.373] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.374] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.374] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.374] CloseHandle (hObject=0xffffffff) returned 1 [0275.374] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.374] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.374] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.374] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.374] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.374] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.374] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.375] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.375] CloseHandle (hObject=0xffffffff) returned 1 [0275.375] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.375] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.375] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.375] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.375] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.375] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.375] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.375] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.376] CloseHandle (hObject=0xffffffff) returned 1 [0275.376] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.376] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.376] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.376] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.376] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.376] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.376] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.376] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.376] CloseHandle (hObject=0xffffffff) returned 1 [0275.376] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.377] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.377] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.377] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.377] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.377] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.377] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.377] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.377] CloseHandle (hObject=0xffffffff) returned 1 [0275.377] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.377] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.378] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.378] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.378] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.378] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.378] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.378] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.378] CloseHandle (hObject=0xffffffff) returned 1 [0275.378] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.378] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.378] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.379] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.379] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.379] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.379] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.379] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.379] CloseHandle (hObject=0xffffffff) returned 1 [0275.379] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.379] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.379] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.380] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02L-\x07\x02(2@")) returned 0 [0275.380] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.380] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.380] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.380] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.380] CloseHandle (hObject=0xffffffff) returned 1 [0275.380] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.380] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.380] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0275.380] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0275.380] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.381] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.381] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.381] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.381] CloseHandle (hObject=0xffffffff) returned 1 [0275.381] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.381] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.381] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.381] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02L-\x07\x02(2@")) returned 0 [0275.381] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.381] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.382] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.382] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.383] CloseHandle (hObject=0xffffffff) returned 1 [0275.384] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.384] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.384] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.384] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02L-\x07\x02(2@")) returned 0 [0275.384] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.384] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.384] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.384] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.384] CloseHandle (hObject=0xffffffff) returned 1 [0275.384] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.385] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.385] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="0#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.385] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="0#\x07\x02L-\x07\x02(2@")) returned 0 [0275.385] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.385] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.385] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.385] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.385] CloseHandle (hObject=0xffffffff) returned 1 [0275.385] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.385] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.386] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="@#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.386] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="@#\x07\x02L-\x07\x02(2@")) returned 0 [0275.386] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.386] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.386] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.386] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.386] CloseHandle (hObject=0xffffffff) returned 1 [0275.386] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.386] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.386] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="P#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.387] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="P#\x07\x02L-\x07\x02(2@")) returned 0 [0275.387] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.387] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.387] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.387] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.387] CloseHandle (hObject=0xffffffff) returned 1 [0275.387] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0 [0275.387] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.z49-css-qhb")) returned 0x20 [0275.387] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="`#\x07\x02L-\x07\x02(2@")) returned 0xffffffff [0275.387] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="`#\x07\x02L-\x07\x02(2@")) returned 0 [0275.387] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.388] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.388] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock")) returned 0xffffffff [0275.388] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518fab5a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7642653, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf143f155, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="LOG", cAlternateFileName="")) returned 1 [0275.388] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0275.390] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0275.391] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b [0275.391] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0275.391] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0275.494] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8b, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x8b, lpOverlapped=0x0) returned 1 [0275.495] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8b, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x8b, lpOverlapped=0x0) returned 1 [0275.497] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.530] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.545] CloseHandle (hObject=0x200) returned 1 [0275.545] CloseHandle (hObject=0x1f0) returned 1 [0275.545] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.546] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.546] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518fab5a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7642653, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf143f155, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="LOG", cAlternateFileName="")) returned 0x7e2908 [0275.547] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518fab5a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7642653, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf143f155, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="LOG", cAlternateFileName="")) returned 0 [0275.547] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0275.547] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 1 [0275.548] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.548] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.549] CloseHandle (hObject=0xffffffff) returned 1 [0275.549] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.549] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.549] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="L-\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.549] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="L-\x07\x02ø.\x07\x02(2@")) returned 0 [0275.549] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.549] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.549] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.549] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.550] CloseHandle (hObject=0xffffffff) returned 1 [0275.550] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.550] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.550] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.550] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.550] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.550] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.550] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.550] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.550] CloseHandle (hObject=0xffffffff) returned 1 [0275.551] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.551] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.551] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.551] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.551] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.551] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.551] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.551] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.551] CloseHandle (hObject=0xffffffff) returned 1 [0275.551] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.552] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.552] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.552] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.552] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.552] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.552] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.552] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.552] CloseHandle (hObject=0xffffffff) returned 1 [0275.552] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.552] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.552] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.553] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.553] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.553] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.553] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.553] CloseHandle (hObject=0xffffffff) returned 1 [0275.553] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.553] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.553] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.554] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.554] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.554] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.554] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.554] CloseHandle (hObject=0xffffffff) returned 1 [0275.554] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.554] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.554] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.555] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.555] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.555] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.555] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.555] CloseHandle (hObject=0xffffffff) returned 1 [0275.555] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.555] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.555] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.555] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ì\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.555] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.556] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.556] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.556] CloseHandle (hObject=0xffffffff) returned 1 [0275.556] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.556] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.556] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.556] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02ø.\x07\x02(2@")) returned 0 [0275.556] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.556] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.556] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.557] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.557] CloseHandle (hObject=0xffffffff) returned 1 [0275.557] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.557] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.557] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c#\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.557] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x0c#\x07\x02ø.\x07\x02(2@")) returned 0 [0275.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.557] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.557] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.557] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.558] CloseHandle (hObject=0xffffffff) returned 1 [0275.558] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.558] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.558] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x1c#\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.558] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x1c#\x07\x02ø.\x07\x02(2@")) returned 0 [0275.558] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.558] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.558] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.558] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.558] CloseHandle (hObject=0xffffffff) returned 1 [0275.559] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.559] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.559] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=",#\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.559] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=",#\x07\x02ø.\x07\x02(2@")) returned 0 [0275.559] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.559] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.559] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.559] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.559] CloseHandle (hObject=0xffffffff) returned 1 [0275.559] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.560] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.560] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="<#\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.560] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="<#\x07\x02ø.\x07\x02(2@")) returned 0 [0275.560] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.560] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.560] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.560] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.560] CloseHandle (hObject=0xffffffff) returned 1 [0275.560] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.560] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.560] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="L#\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.561] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="L#\x07\x02ø.\x07\x02(2@")) returned 0 [0275.561] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.561] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.561] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.561] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.561] CloseHandle (hObject=0xffffffff) returned 1 [0275.561] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0 [0275.561] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.z49-css-qhb")) returned 0x20 [0275.561] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\\#\x07\x02ø.\x07\x02(2@")) returned 0xffffffff [0275.562] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\\#\x07\x02ø.\x07\x02(2@")) returned 0 [0275.562] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.562] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.562] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0xffffffff [0275.562] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518fab5a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x518fab5a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x58086a3e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="LOG.old", cAlternateFileName="")) returned 1 [0275.562] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0275.563] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0275.563] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e [0275.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0275.564] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0275.666] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x2e, lpOverlapped=0x0) returned 1 [0275.668] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x2e, lpOverlapped=0x0) returned 1 [0275.670] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.699] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.714] CloseHandle (hObject=0x1f0) returned 1 [0275.715] CloseHandle (hObject=0x200) returned 1 [0275.715] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old.z49-css-qhb")) returned 0 [0275.716] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old.z49-css-qhb")) returned 0x20 [0275.716] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518fab5a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x518fab5a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x58086a3e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="LOG.old", cAlternateFileName="")) returned 0x7e26c8 [0275.716] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x518fab5a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x518fab5a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x58086a3e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x7d8528, dwReserved1=0x7f0110, cFileName="LOG.old", cAlternateFileName="")) returned 0 [0275.716] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0275.716] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old")) returned 1 [0275.717] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old")) returned 0xffffffff [0275.717] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x32, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="MANIFEST-000004", cAlternateFileName="MANIFE~1")) returned 1 [0275.718] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0275.720] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0275.720] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32 [0275.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0275.721] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0275.882] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x32, lpOverlapped=0x0) returned 1 [0275.884] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x32, lpOverlapped=0x0) returned 1 [0275.885] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.915] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.933] CloseHandle (hObject=0x200) returned 1 [0275.933] CloseHandle (hObject=0x1f0) returned 1 [0275.934] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.934] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.934] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x32, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MANIFEST-000004", cAlternateFileName="MANIFE~1")) returned 0x7e2888 [0275.935] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x32, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="MANIFEST-000004", cAlternateFileName="MANIFE~1")) returned 0 [0275.935] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0275.935] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 1 [0275.936] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.936] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.936] CloseHandle (hObject=0xffffffff) returned 1 [0275.937] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.937] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.937] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.937] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.937] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.937] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.937] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.937] CloseHandle (hObject=0xffffffff) returned 1 [0275.937] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.938] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.938] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.938] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.938] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.938] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.938] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.938] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.938] CloseHandle (hObject=0xffffffff) returned 1 [0275.938] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.939] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.939] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.939] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.939] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.939] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.939] CloseHandle (hObject=0xffffffff) returned 1 [0275.939] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.939] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.939] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.940] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.940] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.940] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.940] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.940] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.940] CloseHandle (hObject=0xffffffff) returned 1 [0275.940] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.940] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.940] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.940] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.941] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.941] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.941] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.941] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.941] CloseHandle (hObject=0xffffffff) returned 1 [0275.941] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.941] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.941] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.941] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.941] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.941] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.942] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.942] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.942] CloseHandle (hObject=0xffffffff) returned 1 [0275.942] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.942] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.942] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.942] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.942] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.942] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.942] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.943] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.943] CloseHandle (hObject=0xffffffff) returned 1 [0275.943] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.943] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.943] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.943] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.943] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.943] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.943] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.943] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.944] CloseHandle (hObject=0xffffffff) returned 1 [0275.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.944] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.944] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.944] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.944] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.944] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.944] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.944] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.944] CloseHandle (hObject=0xffffffff) returned 1 [0275.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.945] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.945] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.945] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.945] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.945] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.945] CloseHandle (hObject=0xffffffff) returned 1 [0275.945] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.946] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.946] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.946] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.946] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.946] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.946] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.946] CloseHandle (hObject=0xffffffff) returned 1 [0275.946] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.946] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.946] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.947] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.947] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.947] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.947] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.947] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.947] CloseHandle (hObject=0xffffffff) returned 1 [0275.948] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.948] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.948] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.948] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="p#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.948] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.948] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.948] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.948] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.948] CloseHandle (hObject=0xffffffff) returned 1 [0275.948] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.948] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.948] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.949] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x8c#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.949] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.949] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.949] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.949] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0275.949] CloseHandle (hObject=0xffffffff) returned 1 [0275.949] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0 [0275.949] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004.z49-css-qhb")) returned 0x20 [0275.949] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0275.949] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x22, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x23, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x22, nFileSizeLow=0x0, dwReserved0=0x7de9e0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x9c#\x07\x02\x08/\x07\x02(2@")) returned 0 [0275.949] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0275.950] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb")) returned 0 [0275.950] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000004" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000004")) returned 0xffffffff [0275.950] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7668889, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe7668889, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7668889, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x32, dwReserved0=0x2c, dwReserved1=0x40221d, cFileName="MANIFEST-000004", cAlternateFileName="MANIFE~1")) returned 0 [0275.950] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0275.950] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52964a42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bc8e63, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53454649, dwReserved1=0x30302d54, cFileName="Extension Rules", cAlternateFileName="EXTENS~2")) returned 1 [0275.950] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52964a42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bc8e63, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0275.962] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52964a42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bc8e63, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0275.962] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c2d955, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52c2d955, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa71fbfe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="000003.log", cAlternateFileName="")) returned 1 [0275.963] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0275.964] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0275.965] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ee [0275.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0275.965] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0276.057] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x1ee, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x1ee, lpOverlapped=0x0) returned 1 [0276.060] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x1ee, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x1ee, lpOverlapped=0x0) returned 1 [0276.061] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.093] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.108] CloseHandle (hObject=0x1f0) returned 1 [0276.108] CloseHandle (hObject=0x200) returned 1 [0276.109] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.z49-css-qhb")) returned 0 [0276.109] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.z49-css-qhb")) returned 0x20 [0276.109] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c2d955, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52c2d955, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa71fbfe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="000003.log", cAlternateFileName="")) returned 0x7e26c8 [0276.110] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c2d955, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52c2d955, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa71fbfe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="000003.log", cAlternateFileName="")) returned 0 [0276.110] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0276.110] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1 [0276.111] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 0xffffffff [0276.111] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296986b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x52b62ef4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0276.112] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0276.113] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0276.113] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0276.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0276.114] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0276.287] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x10, lpOverlapped=0x0) returned 1 [0276.288] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x10, lpOverlapped=0x0) returned 1 [0276.289] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.315] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.341] CloseHandle (hObject=0x200) returned 1 [0276.341] CloseHandle (hObject=0x1f0) returned 1 [0276.342] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.342] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.343] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296986b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x52b62ef4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="CURRENT", cAlternateFileName="")) returned 0x7e2888 [0276.343] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296986b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x52b62ef4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0276.343] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0276.343] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 1 [0276.344] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.344] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.344] CloseHandle (hObject=0xffffffff) returned 1 [0276.344] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.344] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.344] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.344] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.344] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.344] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.344] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.344] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.344] CloseHandle (hObject=0xffffffff) returned 1 [0276.345] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.345] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.345] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.345] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.345] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.345] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.345] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.345] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.345] CloseHandle (hObject=0xffffffff) returned 1 [0276.347] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.347] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.347] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.347] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.347] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.347] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.347] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.347] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.347] CloseHandle (hObject=0xffffffff) returned 1 [0276.348] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.348] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.348] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.348] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.348] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.348] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.348] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.348] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.348] CloseHandle (hObject=0xffffffff) returned 1 [0276.348] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.348] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.348] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.349] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.349] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.349] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.349] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.352] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.352] CloseHandle (hObject=0xffffffff) returned 1 [0276.352] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.353] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.353] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.353] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.353] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.353] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.353] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.353] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.353] CloseHandle (hObject=0xffffffff) returned 1 [0276.353] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.353] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.353] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´\"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.353] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="´\"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.353] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.353] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.353] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.354] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.354] CloseHandle (hObject=0xffffffff) returned 1 [0276.354] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.354] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.354] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä\"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.354] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä\"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.354] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.354] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.354] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.354] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.354] CloseHandle (hObject=0xffffffff) returned 1 [0276.354] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.354] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.355] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô\"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.355] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô\"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.355] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.355] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.355] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.355] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.355] CloseHandle (hObject=0xffffffff) returned 1 [0276.355] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.355] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.355] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä\"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.355] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ä\"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.355] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.355] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.356] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.356] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.356] CloseHandle (hObject=0xffffffff) returned 1 [0276.356] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.356] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.356] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô\"\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.356] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ô\"\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.356] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.356] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.356] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.356] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.356] CloseHandle (hObject=0xffffffff) returned 1 [0276.356] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.357] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.357] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.357] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.357] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.357] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.357] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.357] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.357] CloseHandle (hObject=0xffffffff) returned 1 [0276.357] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.357] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.357] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14#\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.357] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14#\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.357] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.357] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.358] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.358] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.358] CloseHandle (hObject=0xffffffff) returned 1 [0276.358] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.358] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.358] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.358] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.358] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.358] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.358] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.358] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.358] CloseHandle (hObject=0xffffffff) returned 1 [0276.358] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0 [0276.359] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.z49-css-qhb")) returned 0x20 [0276.359] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="4#\x07\x02\x80/\x07\x02(2@")) returned 0xffffffff [0276.359] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="4#\x07\x02\x80/\x07\x02(2@")) returned 0 [0276.359] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.359] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.359] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0xffffffff [0276.359] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x40221d, cFileName="LOCK", cAlternateFileName="")) returned 1 [0276.359] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0276.360] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0276.361] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0276.361] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0276.361] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0276.436] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x0, lpOverlapped=0x0) returned 1 [0276.436] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.461] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.472] CloseHandle (hObject=0x1f0) returned 1 [0276.472] CloseHandle (hObject=0x200) returned 1 [0276.472] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.473] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.473] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOCK", cAlternateFileName="")) returned 0x7e2a88 [0276.473] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOCK", cAlternateFileName="")) returned 0 [0276.473] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0276.473] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 1 [0276.474] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.474] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.474] CloseHandle (hObject=0xffffffff) returned 1 [0276.474] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.474] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.474] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84.\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.474] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84.\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.474] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.474] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.474] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.474] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.474] CloseHandle (hObject=0xffffffff) returned 1 [0276.474] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.475] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.475] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.475] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.475] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.475] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.475] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.475] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.475] CloseHandle (hObject=0xffffffff) returned 1 [0276.475] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.475] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.475] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.475] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.475] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.475] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.476] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.476] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.476] CloseHandle (hObject=0xffffffff) returned 1 [0276.476] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.476] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.476] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.476] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.476] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.476] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.476] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.476] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.476] CloseHandle (hObject=0xffffffff) returned 1 [0276.476] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.476] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.476] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.477] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.477] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.477] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.477] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.477] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.477] CloseHandle (hObject=0xffffffff) returned 1 [0276.477] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.477] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.477] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.477] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.477] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.477] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.477] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.477] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.478] CloseHandle (hObject=0xffffffff) returned 1 [0276.478] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.478] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.478] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.478] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.478] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.478] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.478] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.478] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.478] CloseHandle (hObject=0xffffffff) returned 1 [0276.478] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.478] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.478] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´\"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.479] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="´\"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.479] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.479] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.479] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.479] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.479] CloseHandle (hObject=0xffffffff) returned 1 [0276.479] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.479] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.479] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä\"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.479] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ä\"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.479] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.479] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.479] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.479] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.479] CloseHandle (hObject=0xffffffff) returned 1 [0276.480] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.480] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.480] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô\"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.480] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ô\"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.480] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.480] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.480] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.480] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.480] CloseHandle (hObject=0xffffffff) returned 1 [0276.480] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.480] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.480] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä\"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.480] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ä\"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.480] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.480] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.481] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.481] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.481] CloseHandle (hObject=0xffffffff) returned 1 [0276.481] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.481] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.481] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô\"\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.481] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ô\"\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.481] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.481] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.481] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.481] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.481] CloseHandle (hObject=0xffffffff) returned 1 [0276.481] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.481] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.482] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.482] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.482] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.482] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.482] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.482] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.482] CloseHandle (hObject=0xffffffff) returned 1 [0276.482] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.482] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.482] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.482] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14#\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.482] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.482] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.482] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.483] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.483] CloseHandle (hObject=0xffffffff) returned 1 [0276.483] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0 [0276.484] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.z49-css-qhb")) returned 0x20 [0276.484] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02\x08/\x07\x02(2@")) returned 0xffffffff [0276.484] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02\x08/\x07\x02(2@")) returned 0 [0276.484] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.484] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.484] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock")) returned 0xffffffff [0276.484] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf159677d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x88, dwReserved1=0x40221d, cFileName="LOG", cAlternateFileName="")) returned 1 [0276.485] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0276.485] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0276.486] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142 [0276.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0276.486] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0276.557] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x142, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x142, lpOverlapped=0x0) returned 1 [0276.558] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x142, lpOverlapped=0x0) returned 1 [0276.559] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.584] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.595] CloseHandle (hObject=0x200) returned 1 [0276.595] CloseHandle (hObject=0x1f0) returned 1 [0276.595] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.596] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.596] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf159677d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOG", cAlternateFileName="")) returned 0x7e2608 [0276.596] FindNextFileA (in: hFindFile=0x7e2608, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf159677d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOG", cAlternateFileName="")) returned 0 [0276.596] FindClose (in: hFindFile=0x7e2608 | out: hFindFile=0x7e2608) returned 1 [0276.596] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 1 [0276.597] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.597] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.597] CloseHandle (hObject=0xffffffff) returned 1 [0276.597] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.598] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.598] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0276.598] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0276.598] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.598] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.598] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.598] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.598] CloseHandle (hObject=0xffffffff) returned 1 [0276.598] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.598] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.598] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.598] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.598] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.598] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.599] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.599] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.599] CloseHandle (hObject=0xffffffff) returned 1 [0276.599] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.599] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.599] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.599] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.599] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.599] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.599] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.599] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.599] CloseHandle (hObject=0xffffffff) returned 1 [0276.599] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.600] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.600] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.600] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.600] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.600] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.600] CloseHandle (hObject=0xffffffff) returned 1 [0276.600] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.600] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.600] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.600] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.600] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.600] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.601] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.601] CloseHandle (hObject=0xffffffff) returned 1 [0276.601] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.601] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.601] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.601] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.601] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.601] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.601] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.601] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.601] CloseHandle (hObject=0xffffffff) returned 1 [0276.601] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.601] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.601] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.602] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" \"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.602] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.602] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.602] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.602] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.602] CloseHandle (hObject=0xffffffff) returned 1 [0276.602] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.602] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.602] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.602] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="°\"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.602] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.602] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.602] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.602] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.602] CloseHandle (hObject=0xffffffff) returned 1 [0276.603] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.603] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.603] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.603] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="À\"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.603] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.603] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.603] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.603] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.603] CloseHandle (hObject=0xffffffff) returned 1 [0276.603] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.603] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.603] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.603] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="Ð\"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.604] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.604] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.604] CloseHandle (hObject=0xffffffff) returned 1 [0276.604] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.604] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.604] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="à\"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.604] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.604] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.604] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.604] CloseHandle (hObject=0xffffffff) returned 1 [0276.605] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.605] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.605] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ð\"\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.605] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="ð\"\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.605] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.605] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.605] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.605] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.605] CloseHandle (hObject=0xffffffff) returned 1 [0276.605] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.606] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.606] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0276.606] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0276.606] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.606] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.606] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.606] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.606] CloseHandle (hObject=0xffffffff) returned 1 [0276.606] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.606] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.606] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.606] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.606] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.607] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.607] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.607] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.607] CloseHandle (hObject=0xffffffff) returned 1 [0276.607] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0 [0276.607] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.z49-css-qhb")) returned 0x20 [0276.607] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02\x80.\x07\x02(2@")) returned 0xffffffff [0276.607] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02\x80.\x07\x02(2@")) returned 0 [0276.607] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.607] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.607] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0xffffffff [0276.607] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="LOG.old", cAlternateFileName="")) returned 1 [0276.608] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0276.610] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0276.611] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c [0276.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0276.611] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0276.744] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x8c, lpOverlapped=0x0) returned 1 [0276.745] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x8c, lpOverlapped=0x0) returned 1 [0276.746] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.772] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.787] CloseHandle (hObject=0x1f0) returned 1 [0276.787] CloseHandle (hObject=0x200) returned 1 [0276.787] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old.z49-css-qhb")) returned 0 [0276.788] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old.z49-css-qhb")) returned 0x20 [0276.788] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="LOG.old", cAlternateFileName="")) returned 0x7e2888 [0276.788] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="LOG.old", cAlternateFileName="")) returned 0 [0276.789] FindClose (in: hFindFile=0x7e2888 | out: hFindFile=0x7e2888) returned 1 [0276.789] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old")) returned 1 [0276.790] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old")) returned 0xffffffff [0276.790] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x90, dwReserved1=0x40221d, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0276.791] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0276.791] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0276.792] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0276.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0276.792] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0276.864] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x29, lpOverlapped=0x0) returned 1 [0276.865] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x29, lpOverlapped=0x0) returned 1 [0276.866] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.891] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.902] CloseHandle (hObject=0x200) returned 1 [0276.902] CloseHandle (hObject=0x1f0) returned 1 [0276.902] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.903] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.903] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x7e2c48 [0276.903] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0276.903] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0276.903] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 1 [0276.904] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.904] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.904] CloseHandle (hObject=0xffffffff) returned 1 [0276.904] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.905] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.905] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.905] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.905] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.905] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.905] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.905] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.905] CloseHandle (hObject=0xffffffff) returned 1 [0276.905] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.906] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.906] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.906] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.906] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.906] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.906] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.906] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.906] CloseHandle (hObject=0xffffffff) returned 1 [0276.906] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.906] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.906] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.906] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.906] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.906] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.907] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.907] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.907] CloseHandle (hObject=0xffffffff) returned 1 [0276.907] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.907] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.907] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.907] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ð.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.907] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.907] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.907] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.907] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.907] CloseHandle (hObject=0xffffffff) returned 1 [0276.907] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.907] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.908] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.908] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.908] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.908] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.908] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.908] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.908] CloseHandle (hObject=0xffffffff) returned 1 [0276.908] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.908] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.908] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.908] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.908] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.908] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.908] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.908] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.909] CloseHandle (hObject=0xffffffff) returned 1 [0276.909] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.909] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.909] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.909] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.909] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.909] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.909] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.909] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.909] CloseHandle (hObject=0xffffffff) returned 1 [0276.909] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.909] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.909] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.910] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.910] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.910] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.910] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.910] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.910] CloseHandle (hObject=0xffffffff) returned 1 [0276.910] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.910] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.910] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.910] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.910] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.910] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.910] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.910] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.910] CloseHandle (hObject=0xffffffff) returned 1 [0276.910] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.911] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.911] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.911] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="p.\x07\x02 \"\x07\x02(2@")) returned 0 [0276.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.911] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.911] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.911] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.911] CloseHandle (hObject=0xffffffff) returned 1 [0276.911] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.911] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.911] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.911] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0 [0276.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.911] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.912] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.912] CloseHandle (hObject=0xffffffff) returned 1 [0276.912] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.912] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.912] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0 [0276.912] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.912] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.912] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.912] CloseHandle (hObject=0xffffffff) returned 1 [0276.912] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.912] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.913] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.913] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0 [0276.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.913] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.913] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.913] CloseHandle (hObject=0xffffffff) returned 1 [0276.913] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.913] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.913] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0 [0276.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.913] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.913] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.913] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0276.914] CloseHandle (hObject=0xffffffff) returned 1 [0276.914] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0 [0276.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.z49-css-qhb")) returned 0x20 [0276.914] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0xffffffff [0276.914] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84#\x07\x02 \"\x07\x02(2@")) returned 0 [0276.914] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0276.914] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules")) returned 0 [0276.914] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0xffffffff [0276.914] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296715b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296715b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5296715b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x90, dwReserved1=0x40221d, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0276.914] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0276.914] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb6ec148, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53454649, dwReserved1=0x30302d54, cFileName="Extension State", cAlternateFileName="EXTENS~3")) returned 1 [0276.914] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb6ec148, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe4, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0277.605] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb6ec148, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe4, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0277.605] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e23151, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e23151, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa71fbfe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0xe4, dwReserved1=0x40221d, cFileName="000003.log", cAlternateFileName="")) returned 1 [0277.606] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0277.607] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0277.608] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad [0277.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0277.608] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0277.699] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x4ad, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x4ad, lpOverlapped=0x0) returned 1 [0277.867] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x4ad, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x4ad, lpOverlapped=0x0) returned 1 [0277.869] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.896] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.914] CloseHandle (hObject=0x1f0) returned 1 [0277.914] CloseHandle (hObject=0x200) returned 1 [0277.914] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.z49-css-qhb")) returned 0 [0277.915] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.z49-css-qhb")) returned 0x20 [0277.915] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e23151, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e23151, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa71fbfe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="000003.log", cAlternateFileName="")) returned 0x7e25c8 [0277.915] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e23151, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e23151, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa71fbfe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x7d8668, dwReserved1=0x7f6140, cFileName="000003.log", cAlternateFileName="")) returned 0 [0277.915] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0277.916] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1 [0277.917] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 0xffffffff [0277.917] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b55418, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b55418, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b5f051, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0277.917] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0277.919] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0277.919] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10 [0277.919] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0277.920] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.008] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x10, lpOverlapped=0x0) returned 1 [0278.009] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x10, lpOverlapped=0x0) returned 1 [0278.011] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.042] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.057] CloseHandle (hObject=0x200) returned 1 [0278.057] CloseHandle (hObject=0x1f0) returned 1 [0278.057] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.058] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.058] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b55418, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b55418, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b5f051, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="CURRENT", cAlternateFileName="")) returned 0x7e2c48 [0278.058] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b55418, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b55418, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b5f051, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="CURRENT", cAlternateFileName="")) returned 0 [0278.059] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0278.059] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 1 [0278.060] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.060] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.060] CloseHandle (hObject=0xffffffff) returned 1 [0278.060] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.060] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.061] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.061] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.061] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.061] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.061] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.061] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.061] CloseHandle (hObject=0xffffffff) returned 1 [0278.061] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.062] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.062] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.062] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.062] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.062] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.062] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.062] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.062] CloseHandle (hObject=0xffffffff) returned 1 [0278.062] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.063] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.063] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.063] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.063] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.063] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.063] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.063] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.063] CloseHandle (hObject=0xffffffff) returned 1 [0278.063] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.063] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.064] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.064] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.064] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.064] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.064] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.064] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.064] CloseHandle (hObject=0xffffffff) returned 1 [0278.064] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.064] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.064] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.065] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.065] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.065] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.065] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.065] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.065] CloseHandle (hObject=0xffffffff) returned 1 [0278.065] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.065] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.065] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.065] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.065] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.065] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.066] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.066] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.066] CloseHandle (hObject=0xffffffff) returned 1 [0278.066] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.066] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.066] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.066] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0 [0278.066] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.066] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.066] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.067] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.067] CloseHandle (hObject=0xffffffff) returned 1 [0278.067] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.067] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.067] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.067] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0 [0278.067] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.067] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.067] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.067] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.067] CloseHandle (hObject=0xffffffff) returned 1 [0278.068] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.068] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.068] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.068] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0 [0278.068] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.068] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.068] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.068] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.068] CloseHandle (hObject=0xffffffff) returned 1 [0278.068] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.069] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.069] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.069] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0 [0278.069] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.069] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.069] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.069] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.069] CloseHandle (hObject=0xffffffff) returned 1 [0278.069] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.069] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.069] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.070] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0 [0278.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.070] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.070] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.070] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.070] CloseHandle (hObject=0xffffffff) returned 1 [0278.070] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.070] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.070] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.070] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x04#\x07\x02P/\x07\x02(2@")) returned 0 [0278.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.070] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.071] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.071] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.071] CloseHandle (hObject=0xffffffff) returned 1 [0278.071] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.071] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.071] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.071] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02P/\x07\x02(2@")) returned 0 [0278.071] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.071] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.071] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.072] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.072] CloseHandle (hObject=0xffffffff) returned 1 [0278.072] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.072] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.072] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="(#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.072] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="(#\x07\x02P/\x07\x02(2@")) returned 0 [0278.072] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.072] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.072] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.072] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.072] CloseHandle (hObject=0xffffffff) returned 1 [0278.072] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0 [0278.073] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.z49-css-qhb")) returned 0x20 [0278.073] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="8#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.073] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="8#\x07\x02P/\x07\x02(2@")) returned 0 [0278.073] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.073] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.073] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0xffffffff [0278.073] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="LOCK", cAlternateFileName="")) returned 1 [0278.074] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0278.075] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0278.075] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0278.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0278.076] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.230] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x0, lpOverlapped=0x0) returned 1 [0278.230] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.258] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.270] CloseHandle (hObject=0x1f0) returned 1 [0278.270] CloseHandle (hObject=0x200) returned 1 [0278.271] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.272] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.272] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOCK", cAlternateFileName="")) returned 0x7e2548 [0278.272] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOCK", cAlternateFileName="")) returned 0 [0278.272] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0278.272] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 1 [0278.272] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.273] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.273] CloseHandle (hObject=0xffffffff) returned 1 [0278.273] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.273] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.273] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.273] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0 [0278.273] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.273] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.273] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.274] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.274] CloseHandle (hObject=0xffffffff) returned 1 [0278.274] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.274] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.274] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.274] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0 [0278.274] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.274] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.274] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.274] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.274] CloseHandle (hObject=0xffffffff) returned 1 [0278.274] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.275] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.275] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.275] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0 [0278.275] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.275] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.275] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.275] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.275] CloseHandle (hObject=0xffffffff) returned 1 [0278.275] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.275] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.275] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.275] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0 [0278.276] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.276] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.276] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.276] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.276] CloseHandle (hObject=0xffffffff) returned 1 [0278.276] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.276] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.276] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.276] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0 [0278.276] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.276] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.276] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.276] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.276] CloseHandle (hObject=0xffffffff) returned 1 [0278.277] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.277] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.277] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.277] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="P/\x07\x02è.\x07\x02(2@")) returned 0 [0278.277] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.277] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.277] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.277] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.277] CloseHandle (hObject=0xffffffff) returned 1 [0278.277] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.277] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.277] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.278] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.278] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.278] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.278] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.278] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.278] CloseHandle (hObject=0xffffffff) returned 1 [0278.278] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.278] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.278] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.278] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.278] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.278] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.278] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.278] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.279] CloseHandle (hObject=0xffffffff) returned 1 [0278.279] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.279] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.279] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.279] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.279] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.279] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.279] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.279] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.279] CloseHandle (hObject=0xffffffff) returned 1 [0278.279] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.279] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.279] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.280] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.280] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.280] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.280] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.280] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.280] CloseHandle (hObject=0xffffffff) returned 1 [0278.280] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.280] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.280] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.281] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.281] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.281] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.281] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.281] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.281] CloseHandle (hObject=0xffffffff) returned 1 [0278.281] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.281] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.281] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.281] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.281] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.281] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.281] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.282] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.282] CloseHandle (hObject=0xffffffff) returned 1 [0278.282] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.282] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.282] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14#\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.282] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x14#\x07\x02è.\x07\x02(2@")) returned 0 [0278.282] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.282] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.282] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.282] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.282] CloseHandle (hObject=0xffffffff) returned 1 [0278.282] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.283] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.283] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.283] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="$#\x07\x02è.\x07\x02(2@")) returned 0 [0278.283] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.283] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.283] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.283] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.283] CloseHandle (hObject=0xffffffff) returned 1 [0278.283] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0 [0278.283] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.z49-css-qhb")) returned 0x20 [0278.283] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="4#\x07\x02è.\x07\x02(2@")) returned 0xffffffff [0278.283] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="4#\x07\x02è.\x07\x02(2@")) returned 0 [0278.284] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.284] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.284] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock")) returned 0xffffffff [0278.284] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf7cf3ec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x10, dwReserved1=0x40221d, cFileName="LOG", cAlternateFileName="")) returned 1 [0278.284] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0278.288] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0278.289] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142 [0278.290] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0278.290] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.378] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x142, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x142, lpOverlapped=0x0) returned 1 [0278.380] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x142, lpOverlapped=0x0) returned 1 [0278.381] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.410] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.423] CloseHandle (hObject=0x200) returned 1 [0278.423] CloseHandle (hObject=0x1f0) returned 1 [0278.424] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.424] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.424] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf7cf3ec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOG", cAlternateFileName="")) returned 0x7e2508 [0278.425] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf7cf3ec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="LOG", cAlternateFileName="")) returned 0 [0278.425] FindClose (in: hFindFile=0x7e2508 | out: hFindFile=0x7e2508) returned 1 [0278.425] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 1 [0278.426] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.426] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.426] CloseHandle (hObject=0xffffffff) returned 1 [0278.426] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.426] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.426] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.426] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.426] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.427] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.427] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.427] CloseHandle (hObject=0xffffffff) returned 1 [0278.427] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.427] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.427] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.427] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.427] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.427] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.427] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.427] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.427] CloseHandle (hObject=0xffffffff) returned 1 [0278.428] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.428] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.428] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.428] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.428] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.428] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.428] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.428] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.428] CloseHandle (hObject=0xffffffff) returned 1 [0278.428] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.429] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.429] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.429] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.429] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.429] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.429] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.429] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.429] CloseHandle (hObject=0xffffffff) returned 1 [0278.429] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.429] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.429] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.429] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.429] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.430] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.430] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.430] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.430] CloseHandle (hObject=0xffffffff) returned 1 [0278.430] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.430] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.430] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.430] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.430] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.430] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.430] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.430] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.430] CloseHandle (hObject=0xffffffff) returned 1 [0278.430] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.431] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.431] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.431] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.431] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.431] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.431] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.431] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.431] CloseHandle (hObject=0xffffffff) returned 1 [0278.431] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.431] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.431] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.431] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.431] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.431] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.431] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.432] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.432] CloseHandle (hObject=0xffffffff) returned 1 [0278.432] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.432] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.432] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.432] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.432] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.432] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.432] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.432] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.432] CloseHandle (hObject=0xffffffff) returned 1 [0278.432] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.432] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.432] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.433] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.433] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.433] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.433] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.433] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.433] CloseHandle (hObject=0xffffffff) returned 1 [0278.433] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.433] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.433] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.433] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.433] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.433] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.433] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.433] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.434] CloseHandle (hObject=0xffffffff) returned 1 [0278.434] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.434] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.434] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0278.434] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.434] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.434] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.434] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.434] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.434] CloseHandle (hObject=0xffffffff) returned 1 [0278.434] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.434] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.434] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.435] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="\x10#\x07\x02P/\x07\x02(2@")) returned 0 [0278.435] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.435] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.435] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.435] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.435] CloseHandle (hObject=0xffffffff) returned 1 [0278.435] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.435] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.435] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.435] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName=" #\x07\x02P/\x07\x02(2@")) returned 0 [0278.435] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.435] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.435] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.435] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.436] CloseHandle (hObject=0xffffffff) returned 1 [0278.436] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0 [0278.436] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.z49-css-qhb")) returned 0x20 [0278.436] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.436] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x5, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7dadc8, ftLastAccessTime.dwHighDateTime=0x1d, ftLastWriteTime.dwLowDateTime=0x7d0284, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x1f, nFileSizeLow=0x0, dwReserved0=0x7d45d8, dwReserved1=0x0, cFileName="", cAlternateFileName="0#\x07\x02P/\x07\x02(2@")) returned 0 [0278.436] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.436] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.436] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0xffffffff [0278.436] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x1c, dwReserved1=0x40221d, cFileName="LOG.old", cAlternateFileName="")) returned 1 [0278.437] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0278.437] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0278.438] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c [0278.438] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0278.438] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.509] ReadFile (in: hFile=0x1f0, lpBuffer=0x227000c, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x8c, lpOverlapped=0x0) returned 1 [0278.510] WriteFile (in: hFile=0x200, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x8c, lpOverlapped=0x0) returned 1 [0278.511] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.536] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.550] CloseHandle (hObject=0x1f0) returned 1 [0278.550] CloseHandle (hObject=0x200) returned 1 [0278.550] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old.z49-css-qhb")) returned 0 [0278.551] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old.z49-css-qhb")) returned 0x20 [0278.551] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="LOG.old", cAlternateFileName="")) returned 0x7e2b88 [0278.551] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x7d8460, dwReserved1=0x7e2ee0, cFileName="LOG.old", cAlternateFileName="")) returned 0 [0278.551] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0278.551] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old")) returned 1 [0278.552] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old")) returned 0xffffffff [0278.552] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0278.553] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0278.553] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f0 [0278.553] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0278.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0278.554] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.632] ReadFile (in: hFile=0x200, lpBuffer=0x227000c, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19e474*=0x29, lpOverlapped=0x0) returned 1 [0278.633] WriteFile (in: hFile=0x1f0, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x19e474, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19e474*=0x29, lpOverlapped=0x0) returned 1 [0278.634] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.675] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.690] CloseHandle (hObject=0x200) returned 1 [0278.690] CloseHandle (hObject=0x1f0) returned 1 [0278.690] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.691] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.691] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0x7e2908 [0278.691] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x7d8640, dwReserved1=0x7f5138, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0278.691] FindClose (in: hFindFile=0x7e2908 | out: hFindFile=0x7e2908) returned 1 [0278.691] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 1 [0278.693] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.693] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.693] CloseHandle (hObject=0xffffffff) returned 1 [0278.693] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.693] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.693] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.693] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.693] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.694] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.694] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.694] CloseHandle (hObject=0xffffffff) returned 1 [0278.694] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.694] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.694] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.694] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="è.\x07\x02P/\x07\x02(2@")) returned 0 [0278.694] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.694] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.694] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.694] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.695] CloseHandle (hObject=0xffffffff) returned 1 [0278.695] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.695] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.695] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.695] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0 [0278.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.695] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.695] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.695] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.695] CloseHandle (hObject=0xffffffff) returned 1 [0278.695] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.696] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.696] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.696] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0 [0278.696] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.696] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.696] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.696] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.696] CloseHandle (hObject=0xffffffff) returned 1 [0278.696] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.696] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.696] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.697] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0 [0278.697] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.697] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.697] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.697] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.697] CloseHandle (hObject=0xffffffff) returned 1 [0278.697] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.697] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.697] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.697] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0 [0278.697] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.698] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.698] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.698] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.698] CloseHandle (hObject=0xffffffff) returned 1 [0278.698] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.698] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.698] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.698] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0 [0278.698] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.698] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.698] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.699] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.699] CloseHandle (hObject=0xffffffff) returned 1 [0278.699] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.699] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.699] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.699] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ü\"\x07\x02P/\x07\x02(2@")) returned 0 [0278.699] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.699] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.699] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.699] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.699] CloseHandle (hObject=0xffffffff) returned 1 [0278.700] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.700] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.700] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.700] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02P/\x07\x02(2@")) returned 0 [0278.700] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.700] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.700] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.700] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.700] CloseHandle (hObject=0xffffffff) returned 1 [0278.700] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.701] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.701] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.701] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x18#\x07\x02P/\x07\x02(2@")) returned 0 [0278.701] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.701] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.701] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.701] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.701] CloseHandle (hObject=0xffffffff) returned 1 [0278.701] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.701] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.701] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="(#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.702] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="(#\x07\x02P/\x07\x02(2@")) returned 0 [0278.702] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.702] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.702] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.702] CloseHandle (hObject=0xffffffff) returned 1 [0278.702] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.702] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.702] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="8#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.703] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="8#\x07\x02P/\x07\x02(2@")) returned 0 [0278.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.703] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.703] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.703] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.703] CloseHandle (hObject=0xffffffff) returned 1 [0278.703] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.703] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.703] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="H#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.703] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="H#\x07\x02P/\x07\x02(2@")) returned 0 [0278.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.704] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.704] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.704] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.704] CloseHandle (hObject=0xffffffff) returned 1 [0278.704] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.704] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.704] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="X#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.704] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="X#\x07\x02P/\x07\x02(2@")) returned 0 [0278.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.704] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.704] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.705] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0278.705] CloseHandle (hObject=0xffffffff) returned 1 [0278.705] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0 [0278.705] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.z49-css-qhb")) returned 0x20 [0278.705] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001", lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h#\x07\x02P/\x07\x02(2@")) returned 0xffffffff [0278.705] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19e370 | out: lpFindFileData=0x19e370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="h#\x07\x02P/\x07\x02(2@")) returned 0 [0278.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0278.705] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state")) returned 0 [0278.705] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0xffffffff [0278.705] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b52d0c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b52d0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x24, dwReserved1=0x40221d, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0278.705] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0278.705] FindNextFileA (in: hFindFile=0x7e2848, lpFindFileData=0x19eb44 | out: lpFindFileData=0x19eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9458ec6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9458ec6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53454649, dwReserved1=0x30302d54, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0278.706] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9458ec6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9458ec6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2888 [0278.710] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9458ec6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9458ec6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0278.710] FindNextFileA (in: hFindFile=0x7e2888, lpFindFileData=0x19e8dc | out: lpFindFileData=0x19e8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5574507e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5574507e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5574507e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0278.710] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x19e674 | out: lpFindFileData=0x19e674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5574507e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5574507e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5574507e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2908 [0278.711] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e674 | out: lpFindFileData=0x19e674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5574507e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5574507e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5574507e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.711] FindNextFileA (in: hFindFile=0x7e2908, lpFindFileData=0x19e674 | out: lpFindFileData=0x19e674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551a1ac1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4a5bd1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0278.711] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551a1ac1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4a5bd1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2508 [0278.714] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551a1ac1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4a5bd1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.714] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554b43ec, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5572f0cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0278.714] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x204 [0278.715] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x208 [0278.716] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2c [0278.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0278.717] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.847] ReadFile (in: hFile=0x204, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd2c, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dfa4*=0xd2c, lpOverlapped=0x0) returned 1 [0278.849] WriteFile (in: hFile=0x208, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd2c, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dfa4*=0xd2c, lpOverlapped=0x0) returned 1 [0278.850] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.876] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.890] CloseHandle (hObject=0x204) returned 1 [0278.890] CloseHandle (hObject=0x208) returned 1 [0278.891] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.z49-css-qhb")) returned 0 [0278.892] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.z49-css-qhb")) returned 0x20 [0278.892] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554b43ec, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5572f0cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="icon_128.png", cAlternateFileName="")) returned 0x7e2548 [0278.892] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554b43ec, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5572f0cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0278.892] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0278.893] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0278.894] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0xffffffff [0278.894] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554bb921, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5572f0cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0278.895] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x208 [0278.896] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x204 [0278.896] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0278.897] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0278.897] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0278.986] ReadFile (in: hFile=0x208, lpBuffer=0x227000c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dfa4*=0xa0, lpOverlapped=0x0) returned 1 [0278.988] WriteFile (in: hFile=0x204, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dfa4*=0xa0, lpOverlapped=0x0) returned 1 [0278.989] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.065] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.080] CloseHandle (hObject=0x208) returned 1 [0279.080] CloseHandle (hObject=0x204) returned 1 [0279.080] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.z49-css-qhb")) returned 0 [0279.081] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.z49-css-qhb")) returned 0x20 [0279.081] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554bb921, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5572f0cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="icon_16.png", cAlternateFileName="")) returned 0x7e2708 [0279.082] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554bb921, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5572f0cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0279.082] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0279.082] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0279.083] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0xffffffff [0279.083] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554ca385, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554cea98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0279.084] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x204 [0279.084] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x208 [0279.085] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0279.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0279.085] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0279.246] ReadFile (in: hFile=0x204, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dfa4*=0x5c, lpOverlapped=0x0) returned 1 [0279.248] WriteFile (in: hFile=0x208, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dfa4*=0x5c, lpOverlapped=0x0) returned 1 [0279.249] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.281] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.295] CloseHandle (hObject=0x204) returned 1 [0279.295] CloseHandle (hObject=0x208) returned 1 [0279.296] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.z49-css-qhb")) returned 0 [0279.296] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.z49-css-qhb")) returned 0x20 [0279.297] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554ca385, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554cea98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0x7e2a88 [0279.297] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554ca385, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554cea98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x7d8550, dwReserved1=0x7f1118, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 0 [0279.297] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0279.297] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0279.298] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0xffffffff [0279.298] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554d3fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554d5fc8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x14, dwReserved1=0x40221d, cFileName="main.js", cAlternateFileName="")) returned 1 [0279.299] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x208 [0279.299] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x204 [0279.300] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0279.300] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0279.300] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0279.389] ReadFile (in: hFile=0x208, lpBuffer=0x227000c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dfa4*=0x5f, lpOverlapped=0x0) returned 1 [0279.391] WriteFile (in: hFile=0x204, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dfa4*=0x5f, lpOverlapped=0x0) returned 1 [0279.392] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.423] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.438] CloseHandle (hObject=0x208) returned 1 [0279.438] CloseHandle (hObject=0x204) returned 1 [0279.438] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.z49-css-qhb")) returned 0 [0279.439] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.z49-css-qhb")) returned 0x20 [0279.439] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554d3fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554d5fc8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="main.js", cAlternateFileName="")) returned 0x7e2b88 [0279.439] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554d3fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554d5fc8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x7d8500, dwReserved1=0x7ef108, cFileName="main.js", cAlternateFileName="")) returned 0 [0279.440] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0279.440] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0279.441] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0xffffffff [0279.441] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551b5348, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554dfc08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55727baf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x20, dwReserved1=0x40221d, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0279.442] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x204 [0279.442] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x208 [0279.443] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0279.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0279.443] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0279.530] ReadFile (in: hFile=0x204, lpBuffer=0x227000c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dfa4*=0x2d5, lpOverlapped=0x0) returned 1 [0279.532] WriteFile (in: hFile=0x208, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dfa4*=0x2d5, lpOverlapped=0x0) returned 1 [0279.533] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.561] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.573] CloseHandle (hObject=0x204) returned 1 [0279.573] CloseHandle (hObject=0x208) returned 1 [0279.573] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.z49-css-qhb")) returned 0 [0279.574] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.z49-css-qhb")) returned 0x20 [0279.574] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json", lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551b5348, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554dfc08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55727baf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0x7e2a88 [0279.574] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19dea0 | out: lpFindFileData=0x19dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551b5348, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554dfc08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55727baf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 0 [0279.574] FindClose (in: hFindFile=0x7e2a88 | out: hFindFile=0x7e2a88) returned 1 [0279.574] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1 [0279.576] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0xffffffff [0279.576] FindNextFileA (in: hFindFile=0x7e2508, lpFindFileData=0x19e40c | out: lpFindFileData=0x19e40c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551c64bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a0b75, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a0b75, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="_locales", cAlternateFileName="")) returned 1 [0279.576] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551c64bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a0b75, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a0b75, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7e2a88 [0279.580] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551c64bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a0b75, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a0b75, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.580] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551cd9ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d0100, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551d0100, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0279.580] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551cd9ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d0100, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551d0100, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0279.580] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551cd9ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d0100, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551d0100, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="..", cAlternateFileName="")) returned 1 [0279.580] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d0100, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d2808, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.581] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0279.582] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0279.582] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0279.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0279.583] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0279.711] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x101, lpOverlapped=0x0) returned 1 [0279.713] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x101, lpOverlapped=0x0) returned 1 [0279.714] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.747] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.763] CloseHandle (hObject=0x20c) returned 1 [0279.764] CloseHandle (hObject=0x210) returned 1 [0279.764] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.z49-css-qhb")) returned 0 [0279.765] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.z49-css-qhb")) returned 0x20 [0279.765] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d0100, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d2808, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2648 [0279.765] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d0100, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d2808, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.766] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0279.768] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0279.769] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0279.769] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d0100, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d2808, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x778c9fd0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.769] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0279.769] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551dc455, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551deb68, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551deb68, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="bg", cAlternateFileName="")) returned 1 [0279.769] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551dc455, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551deb68, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551deb68, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0279.770] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551dc455, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551deb68, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551deb68, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0279.770] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551deb68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551e1268, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.770] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0279.771] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0279.771] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0279.771] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0279.772] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0279.920] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x110, lpOverlapped=0x0) returned 1 [0279.922] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x110, lpOverlapped=0x0) returned 1 [0279.924] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.948] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.960] CloseHandle (hObject=0x210) returned 1 [0279.960] CloseHandle (hObject=0x20c) returned 1 [0279.960] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.z49-css-qhb")) returned 0 [0279.961] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.z49-css-qhb")) returned 0x20 [0279.961] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551deb68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551e1268, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e26c8 [0279.961] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551deb68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551e1268, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.961] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0279.961] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0279.962] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0279.962] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551deb68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551e1268, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.962] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0279.962] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551eaeb6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551efcd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551efcd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="ca", cAlternateFileName="")) returned 1 [0279.962] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551eaeb6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551efcd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551efcd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0279.963] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551eaeb6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551efcd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551efcd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0279.963] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551efcd8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551f23d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.964] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0279.964] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0279.965] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0279.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0279.965] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0280.049] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0280.051] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0280.052] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.084] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.099] CloseHandle (hObject=0x20c) returned 1 [0280.099] CloseHandle (hObject=0x210) returned 1 [0280.100] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.z49-css-qhb")) returned 0 [0280.100] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.z49-css-qhb")) returned 0x20 [0280.100] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551efcd8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551f23d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2bc8 [0280.101] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551efcd8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551f23d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.101] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0280.101] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0280.102] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0280.102] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551efcd8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551f23d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.102] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0280.102] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551f991d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551fe740, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551fe740, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="cs", cAlternateFileName="")) returned 1 [0280.102] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551f991d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551fe740, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551fe740, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0280.103] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551f991d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551fe740, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551fe740, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0280.103] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551fe740, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55200e38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0280.103] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0280.104] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0280.104] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0280.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0280.105] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0280.258] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0280.260] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0280.261] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.309] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.324] CloseHandle (hObject=0x210) returned 1 [0280.324] CloseHandle (hObject=0x20c) returned 1 [0280.324] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.z49-css-qhb")) returned 0 [0280.325] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.z49-css-qhb")) returned 0x20 [0280.325] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551fe740, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55200e38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0280.325] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551fe740, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55200e38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.326] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0280.326] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0280.327] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0280.327] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551fe740, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55200e38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.328] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0280.328] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5520aa75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5520f8cf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5520f8cf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="da", cAlternateFileName="")) returned 1 [0280.328] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5520aa75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5520f8cf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5520f8cf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0280.329] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5520aa75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5520f8cf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5520f8cf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0280.329] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5520f8cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552146b8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0280.330] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0280.330] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0280.330] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0280.331] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0280.331] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0280.435] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0280.437] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0280.438] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.470] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.486] CloseHandle (hObject=0x20c) returned 1 [0280.486] CloseHandle (hObject=0x210) returned 1 [0280.486] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.z49-css-qhb")) returned 0 [0280.487] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.z49-css-qhb")) returned 0x20 [0280.487] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5520f8cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552146b8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2c48 [0280.487] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5520f8cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552146b8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.487] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0280.488] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0280.489] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0280.489] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5520f8cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552146b8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.489] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0280.489] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5521bc05, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5521e318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5521e318, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="de", cAlternateFileName="")) returned 1 [0280.489] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5521bc05, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5521e318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5521e318, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0280.489] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5521bc05, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5521e318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5521e318, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0280.489] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5521e318, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55220a08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0280.490] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0280.491] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0280.491] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0280.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0280.492] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0280.580] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xea, lpOverlapped=0x0) returned 1 [0280.582] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xea, lpOverlapped=0x0) returned 1 [0280.583] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.614] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.630] CloseHandle (hObject=0x210) returned 1 [0280.630] CloseHandle (hObject=0x20c) returned 1 [0280.631] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.z49-css-qhb")) returned 0 [0280.631] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.z49-css-qhb")) returned 0x20 [0280.631] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5521e318, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55220a08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2708 [0280.632] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5521e318, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55220a08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.632] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0280.632] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0280.633] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0280.633] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5521e318, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55220a08, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.633] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0280.633] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5522cd72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231ba1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55231ba1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="el", cAlternateFileName="")) returned 1 [0280.633] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5522cd72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231ba1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55231ba1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0280.634] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5522cd72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231ba1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55231ba1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0280.634] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5522f48b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231b78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0280.634] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0280.635] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0280.635] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0280.635] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0280.636] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0280.743] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x112, lpOverlapped=0x0) returned 1 [0280.744] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x112, lpOverlapped=0x0) returned 1 [0280.745] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.775] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.790] CloseHandle (hObject=0x20c) returned 1 [0280.790] CloseHandle (hObject=0x210) returned 1 [0280.791] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.z49-css-qhb")) returned 0 [0280.791] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.z49-css-qhb")) returned 0x20 [0280.791] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5522f48b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231b78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2548 [0280.792] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5522f48b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231b78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.792] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0280.792] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0280.793] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0280.793] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5522f48b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231b78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.793] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0280.793] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5523b7c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55240602, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55240602, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="en_GB", cAlternateFileName="")) returned 1 [0280.793] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5523b7c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55240602, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55240602, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0280.795] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5523b7c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55240602, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55240602, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0280.795] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55240602, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55242ce8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0280.796] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0280.796] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0280.797] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0280.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0280.798] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0280.941] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd6, lpOverlapped=0x0) returned 1 [0280.942] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd6, lpOverlapped=0x0) returned 1 [0280.944] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.968] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.980] CloseHandle (hObject=0x210) returned 1 [0280.980] CloseHandle (hObject=0x20c) returned 1 [0280.980] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.z49-css-qhb")) returned 0 [0280.981] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.z49-css-qhb")) returned 0x20 [0280.981] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55240602, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55242ce8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0280.981] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55240602, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55242ce8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.981] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0280.981] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0280.982] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0280.982] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55240602, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55242ce8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0280.982] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0280.982] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5524a244, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5524f067, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5524f067, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="en_US", cAlternateFileName="")) returned 1 [0280.982] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5524a244, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5524f067, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5524f067, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0280.983] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5524a244, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5524f067, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5524f067, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0280.983] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5524f067, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55251748, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0280.984] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0280.984] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0280.985] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0280.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0280.985] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.055] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd7, lpOverlapped=0x0) returned 1 [0281.057] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd7, lpOverlapped=0x0) returned 1 [0281.058] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.085] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.098] CloseHandle (hObject=0x20c) returned 1 [0281.098] CloseHandle (hObject=0x210) returned 1 [0281.099] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.z49-css-qhb")) returned 0 [0281.100] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.z49-css-qhb")) returned 0x20 [0281.100] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5524f067, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55251748, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0281.100] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5524f067, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55251748, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.100] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0281.100] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0281.102] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0281.102] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5524f067, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55251748, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.102] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0281.102] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5525b3bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5525dacb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5525dacb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="es", cAlternateFileName="")) returned 1 [0281.102] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5525b3bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5525dacb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5525dacb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0281.102] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5525b3bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5525dacb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5525dacb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.103] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5525dacb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552601a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.103] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.104] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.105] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0281.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.105] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.237] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xdf, lpOverlapped=0x0) returned 1 [0281.239] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xdf, lpOverlapped=0x0) returned 1 [0281.240] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.266] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.280] CloseHandle (hObject=0x210) returned 1 [0281.280] CloseHandle (hObject=0x20c) returned 1 [0281.280] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.z49-css-qhb")) returned 0 [0281.280] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.z49-css-qhb")) returned 0x20 [0281.280] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5525dacb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552601a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2648 [0281.281] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5525dacb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552601a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.281] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0281.281] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0281.282] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0281.282] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5525dacb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552601a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x557317fe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.282] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0281.285] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5526c52f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5526ec42, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5526ec42, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="es_419", cAlternateFileName="")) returned 1 [0281.285] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5526c52f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5526ec42, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5526ec42, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0281.286] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5526c52f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5526ec42, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5526ec42, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.286] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5526ec42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55271318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55733f0a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.286] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.287] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.288] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0281.288] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.288] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.359] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0281.361] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0281.362] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.388] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.401] CloseHandle (hObject=0x20c) returned 1 [0281.401] CloseHandle (hObject=0x210) returned 1 [0281.402] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.z49-css-qhb")) returned 0 [0281.402] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.z49-css-qhb")) returned 0x20 [0281.402] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5526ec42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55271318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55733f0a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0281.402] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5526ec42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55271318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55733f0a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.403] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0281.403] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0281.404] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0281.404] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5526ec42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55271318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55733f0a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.404] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0281.404] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5527af93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5527fdb5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5527fdb5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="et", cAlternateFileName="")) returned 1 [0281.404] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5527af93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5527fdb5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5527fdb5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0281.404] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5527af93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5527fdb5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5527fdb5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.404] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5527fdb5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55282488, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.405] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.405] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.406] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0281.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.406] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.475] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd6, lpOverlapped=0x0) returned 1 [0281.477] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd6, lpOverlapped=0x0) returned 1 [0281.478] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.504] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.516] CloseHandle (hObject=0x210) returned 1 [0281.516] CloseHandle (hObject=0x20c) returned 1 [0281.517] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.z49-css-qhb")) returned 0 [0281.517] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.z49-css-qhb")) returned 0x20 [0281.517] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5527fdb5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55282488, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0281.518] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5527fdb5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55282488, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.518] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0281.518] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0281.519] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0281.519] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5527fdb5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55282488, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.519] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0281.519] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552899f4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5528e81a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5528e81a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="fi", cAlternateFileName="")) returned 1 [0281.519] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552899f4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5528e81a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5528e81a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0281.519] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552899f4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5528e81a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5528e81a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.519] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5528e81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55290ee8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.520] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.521] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.522] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0281.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.522] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.602] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd9, lpOverlapped=0x0) returned 1 [0281.603] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd9, lpOverlapped=0x0) returned 1 [0281.604] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.628] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.640] CloseHandle (hObject=0x20c) returned 1 [0281.640] CloseHandle (hObject=0x210) returned 1 [0281.640] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.z49-css-qhb")) returned 0 [0281.641] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.z49-css-qhb")) returned 0x20 [0281.641] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5528e81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55290ee8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0281.641] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5528e81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55290ee8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.641] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0281.641] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0281.642] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0281.642] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5528e81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55290ee8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.642] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0281.642] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5529845b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529d27e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5529d27e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="fil", cAlternateFileName="")) returned 1 [0281.642] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5529845b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529d27e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5529d27e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0281.643] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5529845b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529d27e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5529d27e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.643] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5529d27e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529f948, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.643] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.643] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.644] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0281.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.644] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.791] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0281.792] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0281.793] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.823] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.837] CloseHandle (hObject=0x210) returned 1 [0281.837] CloseHandle (hObject=0x20c) returned 1 [0281.837] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.z49-css-qhb")) returned 0 [0281.838] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.z49-css-qhb")) returned 0x20 [0281.838] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5529d27e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529f948, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2708 [0281.839] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5529d27e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529f948, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.839] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0281.839] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0281.841] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0281.841] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5529d27e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529f948, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.841] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0281.841] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552a95cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552abcd6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552abcd6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="fr", cAlternateFileName="")) returned 1 [0281.841] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552a95cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552abcd6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552abcd6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0281.842] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552a95cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552abcd6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552abcd6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.842] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552abcd6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ae3a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.843] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.843] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.844] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0281.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.844] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0281.934] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xde, lpOverlapped=0x0) returned 1 [0281.935] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xde, lpOverlapped=0x0) returned 1 [0281.937] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.969] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.984] CloseHandle (hObject=0x20c) returned 1 [0281.984] CloseHandle (hObject=0x210) returned 1 [0281.984] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.z49-css-qhb")) returned 0 [0281.985] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.z49-css-qhb")) returned 0x20 [0281.985] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552abcd6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ae3a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0281.986] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552abcd6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ae3a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.986] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0281.986] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0281.988] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0281.988] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552abcd6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ae3a8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0281.988] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0281.988] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552b591e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ba743, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552ba743, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="he", cAlternateFileName="")) returned 1 [0281.988] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552b591e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ba743, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552ba743, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0281.988] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552b591e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ba743, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552ba743, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0281.988] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552ba743, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552bf518, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0281.989] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0281.990] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0281.990] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0281.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0281.991] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.080] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe1, lpOverlapped=0x0) returned 1 [0282.082] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe1, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe1, lpOverlapped=0x0) returned 1 [0282.083] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.115] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.130] CloseHandle (hObject=0x210) returned 1 [0282.130] CloseHandle (hObject=0x20c) returned 1 [0282.130] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.z49-css-qhb")) returned 0 [0282.131] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.z49-css-qhb")) returned 0x20 [0282.131] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552ba743, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552bf518, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2bc8 [0282.132] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552ba743, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552bf518, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.132] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0282.132] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0282.133] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0282.133] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552ba743, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552bf518, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.133] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0282.133] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552c91c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552cdfe6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552cdfe6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="hi", cAlternateFileName="")) returned 1 [0282.133] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552c91c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552cdfe6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552cdfe6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0282.134] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552c91c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552cdfe6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552cdfe6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0282.134] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552cdfe6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552d2d98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0282.134] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0282.135] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0282.135] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123 [0282.135] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0282.136] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.266] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0x123, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x123, lpOverlapped=0x0) returned 1 [0282.267] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x123, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x123, lpOverlapped=0x0) returned 1 [0282.268] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.293] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.306] CloseHandle (hObject=0x20c) returned 1 [0282.306] CloseHandle (hObject=0x210) returned 1 [0282.306] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.z49-css-qhb")) returned 0 [0282.307] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.z49-css-qhb")) returned 0x20 [0282.307] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552cdfe6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552d2d98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0282.307] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552cdfe6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552d2d98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.307] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0282.308] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0282.309] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0282.309] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552cdfe6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552d2d98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.309] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0282.309] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552da308, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552df141, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552df141, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="hu", cAlternateFileName="")) returned 1 [0282.309] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552da308, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552df141, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552df141, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0282.310] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552da308, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552df141, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552df141, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0282.310] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552df141, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552e17f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0282.311] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0282.311] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0282.312] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0282.312] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0282.313] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.390] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe6, lpOverlapped=0x0) returned 1 [0282.391] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe6, lpOverlapped=0x0) returned 1 [0282.392] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.417] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.429] CloseHandle (hObject=0x210) returned 1 [0282.429] CloseHandle (hObject=0x20c) returned 1 [0282.430] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.z49-css-qhb")) returned 0 [0282.430] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.z49-css-qhb")) returned 0x20 [0282.431] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552df141, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552e17f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0282.431] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552df141, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552e17f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.431] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0282.431] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0282.432] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0282.432] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552df141, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552e17f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.432] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0282.432] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552e8d7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552edba8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552edba8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="id", cAlternateFileName="")) returned 1 [0282.432] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552e8d7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552edba8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552edba8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0282.432] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552e8d7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552edba8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552edba8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0282.432] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552edba8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552f0258, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0282.433] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0282.434] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0282.434] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0282.434] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0282.435] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.510] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd0, lpOverlapped=0x0) returned 1 [0282.512] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd0, lpOverlapped=0x0) returned 1 [0282.513] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.638] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.649] CloseHandle (hObject=0x20c) returned 1 [0282.649] CloseHandle (hObject=0x210) returned 1 [0282.649] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.z49-css-qhb")) returned 0 [0282.650] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.z49-css-qhb")) returned 0x20 [0282.650] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552edba8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552f0258, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2548 [0282.650] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552edba8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552f0258, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.650] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0282.650] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0282.651] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0282.651] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552edba8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552f0258, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.651] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0282.651] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552f9ef6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fed19, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552fed19, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="it", cAlternateFileName="")) returned 1 [0282.652] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552f9ef6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fed19, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552fed19, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2bc8 [0282.652] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552f9ef6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fed19, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552fed19, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0282.652] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552fed19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fecb8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0282.652] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0282.667] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0282.668] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0282.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0282.668] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.739] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0282.740] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0282.741] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.764] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.776] CloseHandle (hObject=0x210) returned 1 [0282.776] CloseHandle (hObject=0x20c) returned 1 [0282.776] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.z49-css-qhb")) returned 0 [0282.777] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.z49-css-qhb")) returned 0x20 [0282.777] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552fed19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fecb8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e26c8 [0282.777] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552fed19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fecb8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.777] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0282.777] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0282.778] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0282.778] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552fed19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fecb8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.779] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0282.782] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5530895a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5530d780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="ja", cAlternateFileName="")) returned 1 [0282.782] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5530895a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5530d780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e25c8 [0282.782] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5530895a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5530d780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0282.782] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5530d780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d718, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0282.783] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0282.783] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0282.783] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0282.784] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0282.784] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.852] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xec, lpOverlapped=0x0) returned 1 [0282.853] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xec, lpOverlapped=0x0) returned 1 [0282.854] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.879] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.890] CloseHandle (hObject=0x20c) returned 1 [0282.890] CloseHandle (hObject=0x210) returned 1 [0282.890] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.z49-css-qhb")) returned 0 [0282.891] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.z49-css-qhb")) returned 0x20 [0282.891] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5530d780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d718, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0282.891] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5530d780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d718, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.891] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0282.891] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0282.892] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0282.892] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5530d780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d718, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0282.892] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0282.893] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553173b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5531c1d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5531c1d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="ko", cAlternateFileName="")) returned 1 [0282.893] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553173b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5531c1d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5531c1d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2708 [0282.893] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553173b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5531c1d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5531c1d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0282.893] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5531c1d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55320f98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0282.894] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0282.895] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0282.895] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0282.895] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0282.895] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0282.963] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe6, lpOverlapped=0x0) returned 1 [0282.964] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe6, lpOverlapped=0x0) returned 1 [0282.965] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.990] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.001] CloseHandle (hObject=0x210) returned 1 [0283.001] CloseHandle (hObject=0x20c) returned 1 [0283.001] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.z49-css-qhb")) returned 0 [0283.002] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.z49-css-qhb")) returned 0x20 [0283.002] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5531c1d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55320f98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0283.002] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5531c1d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55320f98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.002] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0283.002] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0283.003] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0283.003] FindNextFileA (in: hFindFile=0x7e2708, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5531c1d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55320f98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.003] FindClose (in: hFindFile=0x7e2708 | out: hFindFile=0x7e2708) returned 1 [0283.003] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5532ac3c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5533217d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5533217d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="lt", cAlternateFileName="")) returned 1 [0283.003] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5532ac3c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5533217d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5533217d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0283.004] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5532ac3c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5533217d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5533217d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.004] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5532fa64, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55332108, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.004] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.005] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.005] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0283.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.005] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0283.116] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe4, lpOverlapped=0x0) returned 1 [0283.117] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe4, lpOverlapped=0x0) returned 1 [0283.118] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.141] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.190] CloseHandle (hObject=0x20c) returned 1 [0283.190] CloseHandle (hObject=0x210) returned 1 [0283.191] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.z49-css-qhb")) returned 0 [0283.191] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.z49-css-qhb")) returned 0x20 [0283.191] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5532fa64, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55332108, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0283.191] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5532fa64, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55332108, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.191] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0283.191] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0283.192] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0283.192] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5532fa64, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55332108, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.193] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0283.193] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5533e4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55340bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55340bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="lv", cAlternateFileName="")) returned 1 [0283.193] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5533e4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55340bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55340bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e26c8 [0283.194] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5533e4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55340bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55340bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.194] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55340bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55343278, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.194] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.194] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.195] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0283.195] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.195] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0283.286] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe9, lpOverlapped=0x0) returned 1 [0283.287] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe9, lpOverlapped=0x0) returned 1 [0283.288] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.316] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.332] CloseHandle (hObject=0x210) returned 1 [0283.332] CloseHandle (hObject=0x20c) returned 1 [0283.332] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.z49-css-qhb")) returned 0 [0283.333] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.z49-css-qhb")) returned 0x20 [0283.333] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55340bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55343278, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0283.333] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55340bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55343278, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.333] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0283.333] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0283.335] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0283.335] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55340bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55343278, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.335] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0283.335] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5534cf30, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5534f643, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5534f643, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="ms", cAlternateFileName="")) returned 1 [0283.335] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5534cf30, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5534f643, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5534f643, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0283.335] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5534cf30, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5534f643, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5534f643, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.335] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5534f643, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55351cd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.336] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.337] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.338] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0283.338] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.338] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0283.431] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd2, lpOverlapped=0x0) returned 1 [0283.433] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd2, lpOverlapped=0x0) returned 1 [0283.434] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.457] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.468] CloseHandle (hObject=0x20c) returned 1 [0283.469] CloseHandle (hObject=0x210) returned 1 [0283.469] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.z49-css-qhb")) returned 0 [0283.469] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.z49-css-qhb")) returned 0x20 [0283.469] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5534f643, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55351cd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0283.470] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5534f643, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55351cd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.470] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0283.470] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0283.471] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0283.471] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5534f643, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55351cd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.471] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0283.471] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5535b994, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553607b6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553607b6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="nl", cAlternateFileName="")) returned 1 [0283.471] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5535b994, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553607b6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553607b6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0283.471] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5535b994, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553607b6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553607b6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.471] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553607b6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55362e48, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.472] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.472] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.473] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0283.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.473] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0283.542] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0283.543] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0283.544] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.568] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.579] CloseHandle (hObject=0x210) returned 1 [0283.579] CloseHandle (hObject=0x20c) returned 1 [0283.579] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.z49-css-qhb")) returned 0 [0283.580] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.z49-css-qhb")) returned 0x20 [0283.580] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553607b6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55362e48, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0283.580] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553607b6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55362e48, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.580] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0283.580] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0283.581] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0283.581] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553607b6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55362e48, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.581] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0283.582] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5536f21e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5537402a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5537402a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="no", cAlternateFileName="")) returned 1 [0283.582] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5536f21e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5537402a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5537402a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0283.582] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5536f21e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5537402a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5537402a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.582] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5537402a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553766c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.582] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.583] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.584] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0283.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.584] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0283.758] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xcb, lpOverlapped=0x0) returned 1 [0283.759] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xcb, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xcb, lpOverlapped=0x0) returned 1 [0283.760] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.785] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.796] CloseHandle (hObject=0x20c) returned 1 [0283.796] CloseHandle (hObject=0x210) returned 1 [0283.796] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.z49-css-qhb")) returned 0 [0283.797] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.z49-css-qhb")) returned 0x20 [0283.797] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5537402a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553766c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0283.797] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5537402a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553766c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.797] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0283.797] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0283.798] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0283.798] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5537402a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553766c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.798] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0283.798] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538038e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55382aa1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55382aa1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="pl", cAlternateFileName="")) returned 1 [0283.798] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538038e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55382aa1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55382aa1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0283.799] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538038e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55382aa1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55382aa1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.799] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55382aa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55385128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.799] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.800] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.800] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0283.800] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.800] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0283.882] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xd9, lpOverlapped=0x0) returned 1 [0283.883] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xd9, lpOverlapped=0x0) returned 1 [0283.884] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.912] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.926] CloseHandle (hObject=0x210) returned 1 [0283.926] CloseHandle (hObject=0x20c) returned 1 [0283.927] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.z49-css-qhb")) returned 0 [0283.927] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.z49-css-qhb")) returned 0x20 [0283.927] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55382aa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55385128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0283.928] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55382aa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55385128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.928] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0283.928] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0283.929] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0283.929] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55382aa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55385128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0283.929] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0283.929] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538ede3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55393c15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55393c15, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0283.929] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538ede3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55393c15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55393c15, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0283.930] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538ede3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55393c15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55393c15, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0283.930] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55393c15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55396298, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0283.930] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0283.932] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0283.932] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0283.932] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0283.933] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.007] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xde, lpOverlapped=0x0) returned 1 [0284.009] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xde, lpOverlapped=0x0) returned 1 [0284.010] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.036] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.050] CloseHandle (hObject=0x20c) returned 1 [0284.050] CloseHandle (hObject=0x210) returned 1 [0284.050] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.z49-css-qhb")) returned 0 [0284.051] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.z49-css-qhb")) returned 0x20 [0284.051] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55393c15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55396298, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0284.051] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55393c15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55396298, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.051] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0284.052] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0284.053] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0284.053] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55393c15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55396298, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.053] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0284.053] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539d857, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a2679, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553a2679, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0284.053] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539d857, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a2679, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553a2679, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0284.053] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539d857, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a2679, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553a2679, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.054] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a2679, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a4cf8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.054] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.055] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.055] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0284.055] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.056] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.138] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0284.139] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe0, lpOverlapped=0x0) returned 1 [0284.141] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.230] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.242] CloseHandle (hObject=0x210) returned 1 [0284.242] CloseHandle (hObject=0x20c) returned 1 [0284.243] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.z49-css-qhb")) returned 0 [0284.243] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.z49-css-qhb")) returned 0x20 [0284.243] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a2679, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a4cf8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0284.244] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a2679, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a4cf8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.244] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0284.244] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0284.245] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0284.245] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a2679, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a4cf8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.245] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0284.245] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553b37e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553b860f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553b860f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="ro", cAlternateFileName="")) returned 1 [0284.245] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553b37e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553b860f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553b860f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0284.246] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553b37e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553b860f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553b860f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.246] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553b860f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553bac88, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.246] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.247] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.247] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0284.247] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.248] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.318] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xde, lpOverlapped=0x0) returned 1 [0284.320] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xde, lpOverlapped=0x0) returned 1 [0284.321] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.346] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.360] CloseHandle (hObject=0x20c) returned 1 [0284.360] CloseHandle (hObject=0x210) returned 1 [0284.360] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.z49-css-qhb")) returned 0 [0284.361] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.z49-css-qhb")) returned 0x20 [0284.361] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553b860f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553bac88, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2b48 [0284.361] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553b860f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553bac88, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.361] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0284.362] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0284.363] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0284.363] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553b860f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553bac88, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.363] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0284.363] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553c2245, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c7077, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553c7077, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="ru", cAlternateFileName="")) returned 1 [0284.363] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553c2245, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c7077, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553c7077, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0284.363] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553c2245, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c7077, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553c7077, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.363] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553c7077, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c6fd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.364] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.365] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.365] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0284.365] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.366] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.436] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x110, lpOverlapped=0x0) returned 1 [0284.437] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x110, lpOverlapped=0x0) returned 1 [0284.438] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.463] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.475] CloseHandle (hObject=0x210) returned 1 [0284.475] CloseHandle (hObject=0x20c) returned 1 [0284.475] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.z49-css-qhb")) returned 0 [0284.476] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.z49-css-qhb")) returned 0x20 [0284.476] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553c7077, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c6fd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0284.476] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553c7077, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c6fd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.476] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0284.476] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0284.477] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0284.477] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553c7077, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c6fd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.477] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0284.477] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553d2122, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5bbe, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553d5bbe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="sk", cAlternateFileName="")) returned 1 [0284.477] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553d2122, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5bbe, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553d5bbe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0284.478] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553d2122, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5bbe, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553d5bbe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.478] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553d5bbe, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5a38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.478] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.479] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.479] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0284.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.480] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.551] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe3, lpOverlapped=0x0) returned 1 [0284.552] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe3, lpOverlapped=0x0) returned 1 [0284.554] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.578] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.590] CloseHandle (hObject=0x20c) returned 1 [0284.590] CloseHandle (hObject=0x210) returned 1 [0284.590] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.z49-css-qhb")) returned 0 [0284.591] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.z49-css-qhb")) returned 0x20 [0284.591] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553d5bbe, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5a38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e25c8 [0284.591] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553d5bbe, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5a38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.591] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0284.591] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0284.592] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0284.592] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553d5bbe, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5a38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x18, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.592] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0284.592] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553e6d3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553ea7d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553ea7d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="sl", cAlternateFileName="")) returned 1 [0284.592] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553e6d3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553ea7d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553ea7d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b88 [0284.686] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553e6d3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553ea7d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553ea7d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.690] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553ea7d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553eb9c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.691] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.692] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.694] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0284.694] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.695] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.766] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xdf, lpOverlapped=0x0) returned 1 [0284.767] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xdf, lpOverlapped=0x0) returned 1 [0284.768] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.794] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.806] CloseHandle (hObject=0x210) returned 1 [0284.806] CloseHandle (hObject=0x20c) returned 1 [0284.806] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.z49-css-qhb")) returned 0 [0284.807] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.z49-css-qhb")) returned 0x20 [0284.807] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553ea7d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553eb9c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e25c8 [0284.807] FindNextFileA (in: hFindFile=0x7e25c8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553ea7d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553eb9c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.807] FindClose (in: hFindFile=0x7e25c8 | out: hFindFile=0x7e25c8) returned 1 [0284.807] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0284.808] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0284.808] FindNextFileA (in: hFindFile=0x7e2b88, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553ea7d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553eb9c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.808] FindClose (in: hFindFile=0x7e2b88 | out: hFindFile=0x7e2b88) returned 1 [0284.808] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553f6fa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fd14a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553fd14a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="sr", cAlternateFileName="")) returned 1 [0284.808] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553f6fa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fd14a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553fd14a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2548 [0284.809] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553f6fa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fd14a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553fd14a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.809] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553fd14a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fcb38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.809] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.810] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.810] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0284.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.811] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0284.888] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x104, lpOverlapped=0x0) returned 1 [0284.889] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x104, lpOverlapped=0x0) returned 1 [0284.890] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.932] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.944] CloseHandle (hObject=0x20c) returned 1 [0284.944] CloseHandle (hObject=0x210) returned 1 [0284.944] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.z49-css-qhb")) returned 0 [0284.945] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.z49-css-qhb")) returned 0x20 [0284.945] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553fd14a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fcb38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e26c8 [0284.945] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553fd14a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fcb38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.945] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0284.945] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0284.946] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0284.946] FindNextFileA (in: hFindFile=0x7e2548, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553fd14a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fcb38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0284.946] FindClose (in: hFindFile=0x7e2548 | out: hFindFile=0x7e2548) returned 1 [0284.946] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5541a6c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55429128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55429128, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="sv", cAlternateFileName="")) returned 1 [0284.946] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5541a6c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55429128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55429128, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2648 [0284.946] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5541a6c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55429128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55429128, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0284.946] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55429128, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5542b168, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0284.947] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0284.947] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0284.948] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0284.948] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0284.948] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0285.024] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xe2, lpOverlapped=0x0) returned 1 [0285.025] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xe2, lpOverlapped=0x0) returned 1 [0285.027] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.057] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.072] CloseHandle (hObject=0x210) returned 1 [0285.072] CloseHandle (hObject=0x20c) returned 1 [0285.072] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.z49-css-qhb")) returned 0 [0285.073] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.z49-css-qhb")) returned 0x20 [0285.073] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55429128, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5542b168, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0285.073] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55429128, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5542b168, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.073] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0285.073] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0285.074] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0285.074] FindNextFileA (in: hFindFile=0x7e2648, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55429128, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5542b168, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.074] FindClose (in: hFindFile=0x7e2648 | out: hFindFile=0x7e2648) returned 1 [0285.074] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5543548c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543c9c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5543c9c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="th", cAlternateFileName="")) returned 1 [0285.074] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5543548c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543c9c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5543c9c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2c48 [0285.075] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5543548c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543c9c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5543c9c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0285.075] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543c9c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543e9e8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0285.075] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0285.077] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0285.077] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0285.077] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0285.077] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0285.216] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x104, lpOverlapped=0x0) returned 1 [0285.218] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x104, lpOverlapped=0x0) returned 1 [0285.219] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.243] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.254] CloseHandle (hObject=0x20c) returned 1 [0285.254] CloseHandle (hObject=0x210) returned 1 [0285.255] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.z49-css-qhb")) returned 0 [0285.255] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.z49-css-qhb")) returned 0x20 [0285.256] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543c9c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543e9e8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e26c8 [0285.256] FindNextFileA (in: hFindFile=0x7e26c8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543c9c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543e9e8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.256] FindClose (in: hFindFile=0x7e26c8 | out: hFindFile=0x7e26c8) returned 1 [0285.256] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0285.257] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0285.257] FindNextFileA (in: hFindFile=0x7e2c48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543c9c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543e9e8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.257] FindClose (in: hFindFile=0x7e2c48 | out: hFindFile=0x7e2c48) returned 1 [0285.257] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55452973, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457773, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55457773, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="tr", cAlternateFileName="")) returned 1 [0285.257] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55452973, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457773, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55457773, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0285.258] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55452973, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457773, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55457773, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0285.258] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55457773, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457088, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0285.258] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0285.259] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0285.259] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0285.259] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0285.260] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0285.333] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0285.334] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xdd, lpOverlapped=0x0) returned 1 [0285.335] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.363] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.378] CloseHandle (hObject=0x210) returned 1 [0285.378] CloseHandle (hObject=0x20c) returned 1 [0285.378] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.z49-css-qhb")) returned 0 [0285.379] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.z49-css-qhb")) returned 0x20 [0285.379] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55457773, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457088, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2bc8 [0285.379] FindNextFileA (in: hFindFile=0x7e2bc8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55457773, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457088, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.380] FindClose (in: hFindFile=0x7e2bc8 | out: hFindFile=0x7e2bc8) returned 1 [0285.380] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0285.381] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0285.381] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55457773, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457088, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.381] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0285.381] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55463ac8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554661d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554661d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="uk", cAlternateFileName="")) returned 1 [0285.381] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55463ac8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554661d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554661d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2b48 [0285.382] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55463ac8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554661d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554661d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0285.382] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554661d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554681f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0285.382] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0285.383] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0285.384] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0285.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0285.384] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0285.469] ReadFile (in: hFile=0x20c, lpBuffer=0x227000c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0x10e, lpOverlapped=0x0) returned 1 [0285.471] WriteFile (in: hFile=0x210, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0x10e, lpOverlapped=0x0) returned 1 [0285.472] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.502] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.516] CloseHandle (hObject=0x20c) returned 1 [0285.516] CloseHandle (hObject=0x210) returned 1 [0285.517] MoveFileA (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.z49-css-qhb")) returned 0 [0285.517] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.z49-css-qhb")) returned 0x20 [0285.518] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554661d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554681f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0x7e2ac8 [0285.518] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19d9d0 | out: lpFindFileData=0x19d9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554661d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554681f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x7d0260, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.518] FindClose (in: hFindFile=0x7e2ac8 | out: hFindFile=0x7e2ac8) returned 1 [0285.518] DeleteFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0285.520] GetFileAttributesA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0285.520] FindNextFileA (in: hFindFile=0x7e2b48, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554661d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554681f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0285.520] FindClose (in: hFindFile=0x7e2b48 | out: hFindFile=0x7e2b48) returned 1 [0285.520] FindNextFileA (in: hFindFile=0x7e2a88, lpFindFileData=0x19e1a4 | out: lpFindFileData=0x19e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55479a4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5547e881, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5547e881, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65676173, dwReserved1=0x736a2e73, cFileName="vi", cAlternateFileName="")) returned 1 [0285.520] FindFirstFileA (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55479a4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5547e881, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5547e881, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName=".", cAlternateFileName="")) returned 0x7e2ac8 [0285.520] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55479a4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5547e881, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5547e881, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="..", cAlternateFileName="")) returned 1 [0285.520] FindNextFileA (in: hFindFile=0x7e2ac8, lpFindFileData=0x19df3c | out: lpFindFileData=0x19df3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5547e881, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55482fa8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x34, dwReserved1=0x40221d, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0285.521] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x210 [0285.521] CreateFileA (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.z49-css-qhb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.z49-css-qhb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20c [0285.522] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0285.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2270000 [0285.522] VirtualAlloc (lpAddress=0x2270000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2270000 [0285.607] ReadFile (in: hFile=0x210, lpBuffer=0x227000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesRead=0x19dad4*=0xed, lpOverlapped=0x0) returned 1 [0285.609] WriteFile (in: hFile=0x20c, lpBuffer=0x227000c*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x19dad4, lpOverlapped=0x0 | out: lpBuffer=0x227000c*, lpNumberOfBytesWritten=0x19dad4*=0xed, lpOverlapped=0x0) returned 1 [0285.611] VirtualFree (lpAddress=0x2270000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.642] VirtualFree (lpAddress=0x2270000, dwSize=0x0, dwFreeType=0x8000) Thread: id = 7 os_tid = 0x378